Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS Issue: Two Date: December 2018

AWS and TPWS Application Requirements

Synopsis This document sets out requirements and guidance for the application of the United Kingdom (UK) Class B train protection system ‘TPWS’, which comprises the Automatic Warning System (AWS) and the Train Protection and Warning System (TPWS).

Copyright in the Railway Group documents is owned by Rail Safety and Standards Board Limited. All rights are hereby reserved. No Railway Group document (in whole or in part) may be reproduced, stored in a retrieval system, or transmitted, in any form or means, without the prior written permission of Rail Safety and Standards Board Limited, or as expressly permitted by law.

RSSB members are granted copyright licence in accordance with the Constitution Agreement relating to Rail Safety and Standards Board Limited.

In circumstances where Rail Safety and Standards Board Limited has granted a particular person or organisation permission to copy extracts from Railway Group documents, Rail Safety and Standards Board Limited accepts no responsibility for, nor any liability in connection with, the use of such extracts, or any claims arising therefrom. This disclaimer applies to all forms of media in which extracts from Railway Group documents may be reproduced.

Published by RSSB

© Copyright 2018 Rail Safety and Standards Board Limited Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Issue Record

Issue Date Comments One 03/03/2018 New document containing material from GERT8075 issue two and GEGN8675 issue two not within scope of Railway Group Standards.

Two 01/12/2018 Revised Part 5 and Appendices A, B and C incorporating requirements for VDU implementation of DMI and integration with ETCS. Revised Part 5 also replaces former Appendix D which is now not used. AWS/TPWS output requirements formerly in Part 5 moved to section 4.3.

Revisions have been marked by a vertical black line in this issue. Definitions and References may also have been updated but these are not marked by a vertical black line.

Superseded Documents The following Railway Group documents are superseded, either in whole or in part as indicated:

Superseded documents Sections superseded Date when sections are superseded RIS-0775-CCS issue one AWS All 01/12/2018 and TPWS Application Requirements

Supply The authoritative version of this document is available at www.rssb.co.uk/railway- group-standards. Enquiries on this document can be submitted through the RSSB Customer Self-Service Portal https://customer-portal.rssb.co.uk/

Page 2 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Contents

Section Description Page

Part 1 Purpose and Introduction 7 1.1 Purpose 7 1.2 Application of this document 7 1.3 Health and safety responsibilities 8 1.4 Structure of this document 8 1.5 Approval and authorisation of this document 8

Part 2 System Description 9 2.1 General introduction to AWS and TPWS 9 2.2 AWS 10 2.3 TPWS 11

Part 3 Trackside Subsystem Requirements 13 3.1 Requirements for trackside AWS equipment 13 3.2 Requirements for trackside TPWS equipment 29

Part 4 Trainborne Subsystem Requirements 39 4.1 Requirements for trainborne AWS equipment 39 4.2 Requirements for trainborne TPWS equipment 41 4.3 Output requirements 44

Part 5 AWS/TPWS Driver Machine Interface (DMI) 46 5.1 Introduction to the AWS/TPWS DMI 46 5.2 Integrating the AWS/TPWS DMI into a rail vehicle 47 5.3 AWS/TPWS DMI controls 49 5.4 AWS/TPWS DMI indications 64 5.5 AWS/TPWS DMI control functions 76 5.6 AWS/TPWS indication functions 80 5.7 AWS/TPWS onboard subsystem power-up test functions 88 5.8 AWS/TPWS fault indications 90

Part 6 System Availability and Integrity 93 6.1 Availability and integrity of the AWS/TPWS system 93

Appendices 94 Appendix A AWS/TPWS DMI System Models 94

RSSB Page 3 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Appendix B AWS/TPWS Control and Indication Panel 97 Appendix C AWS/TPWS DMI VDU layouts 98 Appendix D Not used 100 Appendix E Guidance on AWS Design Principles 101 Appendix F Guidance on AWS Receiver Sensitivity Testing 102 Appendix G Not used Appendix H Description of AWS and TPWS Trainborne Equipment 104 Appendix I Not used Appendix J AWS and TPWS Trainborne Equipment - Fault and Failure Management 110 Appendix K AWS Testing using a Hand-Held Permanent Magnet 125 Appendix L Guidance on AWS Route Compatibility Assessments 128

Definitions 129

References 132

Page 4 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

List of Figures

Figure 1: TPWS typical layout 11

Figure 2: Example designs of AWS caution acknowledgement control 53

Figure 3: Example of the AWS warning acknowledged indication ('sunflower') 71

Figure 4: AWS/TPWS brake demand indication combination and transitions 84

Figure 5: AWS/TPWS DMI structural viewpoint 94

Figure 6: Train driver operational context viewpoint: AWS DMI use cases 95

Figure 7: Train driver operational context viewpoint: TPWS DMI use cases 96

Figure 8: AWS/TPWS panel layout 97

Figure 9: AWS/TPWS panel dimensions 97

Figure 10: Example layout for touch screen VDU 98

Figure 11: Example layout for soft key VDU 98

Figure 12: Typical AWS/TPWS trainborne sub-system 105

Figure 13: AWS/TPWS right side failure investigation process 111

Figure 14: AWS wrong side failure investigation process 113

Figure 15: Combined AWS/TPWS fault finding guide 117

Figure 16: Combined AWS/TPWS system fault-finding flowchart 118

RSSB Page 5 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

List of Tables

Table 1: Provision of AWS at signals 14

Table 2: Track transmitter frequencies for overspeed protection functionality 37

Table 3: Track transmitter frequencies for train stop functionality 37

Table 4: AWS caution acknowledgement control 51

Table 5: AWS brake demand acknowledgement control 53

Table 6: SPAD brake demand acknowledgement control 54

Table 7: Overspeed brake demand control 56

Table 8: Brake release control 57

Table 9: Train stop override control 59

Table 10: TPWS temporary isolation control 61

Table 11: AWS isolation control 62

Table 12: AWS/TPWS isolation control 63

Table 13: AWS/TPWS DMI indications 64

Table 14: AWS and TPWS audible indications 66

Table 15: AWS warning acknowledged indication ('sunflower') 68

Table 16: Brake demand and acknowledgement indications 71

Table 17: Train stop override indication 73

Table 18: TPWS temporary isolation/fault indication 75

Table 19: Common AWS/TPWS faults 119

Table 20: Test after a 'right side failure’ reported 125

Table 21: Test after a 'wrong side failure’ reported 127

Page 6 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Part 1 Purpose and Introduction

1.1 Purpose

1.1.1 This document is the industry agreed and endorsed standard on the application of the Automatic Warning System (AWS) and the Train Protection and Warning System (TPWS) on the Great Britain (GB) mainline railway network and on trains operating on that network. It is complementary to GERT8075, which sets out requirements for technical compatibility of the AWS and TPWS trackside subsystems with the AWS / TPWS onboard subsystems. 1.1.2 Conformity with the requirements in this document can be used by infrastructure managers (IMs) and railway undertakings (RUs) in discharging their obligations under the Railway Safety Regulations 1999 (RSR 99). 1.1.3 Document ERA/TD/2011-11 List of Class B Systems, published by the European Union Agency for Railways (EUAR), records that ‘TPWS’ is a UK Class B system applicable to the whole network. In this context, ‘TPWS’ includes AWS. 1.1.4 The Control Command and Signalling Technical Specification for Interoperability (CCS TSI) section 3.1 states that ‘The requirements for Class B systems are the responsibility of the relevant Member State’. This Rail Industry Standard, together with Railway Group Standard GERT8075, fulfils that responsibility by setting out the GB industry agreed requirements for ‘TPWS’ on the GB mainline railway. 1.1.5 This document includes the TPWS Driver-Machine Interface (DMI) requirements, which have been developed to control the risk of a driver incorrectly resetting the TPWS and restarting the train after a train protection system intervention. This is sometimes referred to as ‘TPWS reset and go risk’. These requirements support the design of a TPWS DMI which will provide operational functionality consistent with the requirements set out in the Rule Book GERT8000 and the supporting handbook RS522 that all GB mainline train operators have collectively agreed to mandate on themselves. 1.1.6 The requirements in RIS-0775-CCS are available to both suppliers and train operators as widely accepted codes of practice which can be used as a means of applying the CSM RA risk acceptance principles to the hazards of a train passing the end of a signalled movement authority and a train exceeding the permissible speed, in order to control collision risk and derailment risk. They also provide suppliers of rail vehicles and onboard CCS subsystems with a specification of a system which is capable of safe integration into the GB mainline railway.

1.2 Application of this document

1.2.1 Compliance requirements and dates have not been specified because these are the subject of internal procedures or contract conditions. 1.2.2 If you plan to do something that does not comply with a requirement in this RIS, you can ask a Standards Committee to comment on your proposed alternative. If you want a Standards Committee to do this, please submit your deviation application form to RSSB. You can find further advice in the ‘Guidance to applicants and

RSSB Page 7 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

members of Standards Committee on using alternative requirements’, available from RSSB’s website www.rssb.co.uk.

1.3 Health and safety responsibilities

1.3.1 Users of documents published by RSSB are reminded of the need to consider their own responsibilities to ensure health and safety at work and their own duties under health and safety legislation. RSSB does not warrant that compliance with all or any documents published by RSSB is sufficient in itself to ensure safe systems of work or operation or to satisfy such responsibilities or duties.

1.4 Structure of this document

1.4.1 This document sets out a series of requirements that are sequentially numbered. This document also sets out the rationale for the requirement, explaining why the requirement is needed and its purpose and, where relevant, guidance to support the requirement. The rationale and the guidance are prefixed by the letter ‘G’. 1.4.2 Some subjects do not have specific requirements but the subject is addressed through guidance only and, where this is the case, it is distinguished under a heading of ‘Guidance’ and is prefixed by the letter ‘G’.

1.5 Approval and authorisation of this document

1.5.1 The content of this document was approved by Control Command and Signalling Standards Committee on 30 August 2018. 1.5.2 This document was authorised by RSSB on 23 October 2018.

Page 8 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Part 2 System Description

2.1 General introduction to AWS and TPWS

Guidance G 2.1.1 GERT8075 and RIS-0775-CCS cover interface and application requirements for the AWS and the TPWS. Other methods of train protection are in use on some sections of Network Rail routes, including mechanical train stops, non-mechanical (magnetic) train stops and Automatic Train Protection (ATP) systems (which include trial systems introduced by BR on the Great Western and Chiltern lines and the European Train Control System (ETCS)). These systems are not covered in this document. G 2.1.2 AWS and TPWS supplement the indications given by lineside signalling systems. While lineside signals and signs give drivers the information they need on MA and permissible speed, AWS and TPWS are provided to mitigate risk from overrun or overspeed due to any failure to observe or obey lineside signals or signs. G 2.1.3 AWS is provided to give train drivers in-cab warnings on the approach to signals, reductions in permissible speed, temporary / emergency speed restrictions and other locations where the attention of the driver needs to be attracted, such as level crossings. AWS applies the brakes in the event that a driver does not acknowledge the cautionary warnings given by the system. G 2.1.4 Although the Great Western Railway introduced a form of Automatic Train Control (ATC) from 1906, AWS was developed from the Hudd system installed by the London Midland and Scottish Railway on the London, Tilbury & Southend line (where fog was a problem) in 1937. AWS track equipment was gradually installed on most routes over a period from the late 1950s through to the 1980s, and AWS trainborne equipment has been provided on most trains operating on the network since the 1960s. G 2.1.5 Following the Southall accident in 1997, the government decided that a more effective train protection system was required. However, it was considered that provision of a full ATP system could not be justified, partly due to the forthcoming development of the European Train Control System (ETCS), and TPWS was developed as a cost-effective alternative. Following the Ladbroke Grove accident in October 1999 the completion date was brought forward by one year to December 2002. G 2.1.6 TPWS is designed to intervene and apply the train brakes if the train passes a signal displaying a stop aspect or approaches a stop aspect or a speed restriction at too high a speed. Unlike AWS, TPWS does not provide any warnings to the driver, but activates only when it is necessary to make a brake application. Generally, the driver will previously have received a warning from the AWS for the same hazard. G 2.1.7 The original intention was that the name ‘TPWS’ would cover the combination of additional Train Protection (TP) functionality with the existing warning functions given by AWS. Thus ‘TPWS’ should be applied to the whole system, including AWS. This is how the terms were used in Annex B of the CCS TSI, where the combined system is named ‘TPWS’ and it is stated that this ‘includes the functionality of AWS’. G 2.1.8 However, in common usage the term ‘TPWS’ has come to be applied solely to the train protection element of the combined system, with the warning functions still referred to as a separate system called ‘AWS’. Due to the established use of these RSSB Page 9 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

terms, including in the Rule Book, this usage is retained in GERT8075 and RIS-0775- CCS, though in certain areas such as the Driver-Machine Interface (DMI) and self- testing procedures, requirements for the two parts of the system are closely linked.

2.2 AWS

Guidance G 2.2.1 This section provides an overview of how the AWS system operates. G 2.2.2 So far as its application to signals is concerned, the basic AWS system operates as follows: a) As a train approaches a signal, it passes over AWS track equipment (one or more magnets) which is fixed between the running rails. This comprises a permanent magnet producing a south pole, which may be followed (in the direction of travel) by an electromagnet which produces a north pole when it is energised. b) The magnets are sensed by a receiver mounted under the leading end of the train, and the information derived is passed to a logic unit which interfaces with the AWS equipment in the cab and with the train brake system. The equipment in the cab comprises audible and visual indicators, an ‘acknowledgement’ push button, and a switch or similar device for isolating the AWS equipment if it is defective. c) If the signal is displaying a clear aspect, the electromagnet is energised and the train therefore detects a south pole followed by a north pole. This causes a bell (or an electronic equivalent) to sound in the driver’s cab, and the visual indicator displays an ‘all black’ state (that is, the appearance is a black circle – described in the Rule Book as the ‘normal’ indication). No action in respect of the AWS is required of the driver. d) If the signal is displaying a cautionary or stop aspect, the electromagnet is not energised and the train therefore detects only the south pole of the permanent magnet. This causes a horn (or an electronic equivalent) to sound in the driver’s cab and the display shows ‘all black’. The driver has to acknowledge the warning by operating the ‘acknowledgement’ push button. e) When the driver operates the push button, the horn is silenced and the visual indicator changes to a segmented black and yellow circular display (described in the Rule Book as the ‘warning’ indication), as a reminder to the driver that he / she has acknowledged the cautionary or stop aspect being displayed by the signal. f) If the driver fails to acknowledge the warning horn within a set time period, the brakes are applied automatically. The visual indicator remains ‘all black’ and the horn continues to sound. g) If the driver acknowledges the warning after the brakes have been applied, the horn is silenced and the indicator changes to the black and yellow display, but the train brakes are not released until a minimum time period has elapsed and the driver has operated a separate brake release device. G 2.2.3 Facilities are provided within the cab for isolating the on-board AWS equipment alone and for full isolation of AWS and TPWS together. This is necessary in order to cope with equipment failure while the train is in service (failures could result in the train being immobilised, or the horn / bell sounding continuously in the cab, for instance),

Page 10 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

and to deal with a train brought to a stand with its AWS receiver directly over AWS track equipment. G 2.2.4 Track-mounted test magnets may be provided at certain locations, for example on the exit lines from maintenance depots, to give assurance before a train enters service that the trainborne AWS equipment is capable of functioning correctly. G 2.2.5 Where AWS track equipment is provided on the approach to a reduction in permissible speed, a temporary / emergency speed restriction or a signal that cannot display a clear (green) aspect, only a permanent magnet is provided and the cab equipment always operates as on the approach to a signal displaying a caution or stop aspect. The driver receives a warning (as set out in d)), and has to respond to it accordingly, otherwise the brakes are applied automatically as set out in f) and g). G 2.2.6 Where AWS track equipment is passed over by trains travelling in both directions, but is only applicable to movements in one direction, a suppressor magnet may be provided. This incorporates a suppressor coil which can be energised to counteract the magnetic flux from the permanent magnet, so that the receiver on the train will not detect the presence of the AWS track equipment.

2.3 TPWS

Guidance G 2.3.1 TPWS (see Figure 1 for typical layout) is designed to initiate a brake application independently of AWS: a) At selected signals, if a train passes a stop aspect. b) On the approach to selected signals, if a train approaches a stop aspect at excessive speed. c) At other locations (for example, on the approach to a permanent speed restriction or buffer stop) if a train approaches the location at excessive speed.

Figure 1: TPWS typical layout G 2.3.2 The TPWS track sub-system comprises pairs of transmitter loops forming either a train stop system (TSS) or an overspeed system (OSS). These have sometimes been RSSB Page 11 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

referred to as train stop sensor and overspeed sensor, but these terms are not really accurate because it is the trainborne equipment which detects the frequencies transmitted by the track sub-system loops. G 2.3.3 A TSS consists of two loops mounted adjacent to each other in the four foot on the track centre line, such that the magnetic fields transmitted by the two loops overlap and are detected together by the trainborne receiver. G 2.3.4 A TSS brake application is made if, firstly, a valid arming frequency is detected and then, while still detecting the arming frequency, the appropriate trigger frequency is detected, irrespective of train speed. G 2.3.5 The OSS operates on the principle of measuring the time taken for a train to pass two points on the track. If this time is less than a pre-set time an automatic brake application is initiated. On the track, two transmitters, each emitting a different frequency, define the points at which the timing starts and stops. The distance between the two transmitters and the trigger delay timing, which is set on the train, together determine the set speed. G 2.3.6 More than one set of OSS loops may be provided on the approach to a signal to provide more effective control of trains over a wider range of approach speeds. An additional set of OSS loops further from the signal than the primary OSS is sometimes referred to as ‘OSS+’, and an installation incorporating such an additional set of loops may be referred to as ‘TPWS+’. G 2.3.7 To avoid interference problems experienced with closely spaced OSS loops, smaller loops are used on the approach to buffer stops where the required set speed is low. G 2.3.8 In the case of TPWS loops that are associated with a signal (the TSS at the signal and OSS on the approach to the signal), the two transmitters are energised when the signal is required to display a stop aspect. G 2.3.9 When associated with any other location, such as the approach to a speed restriction or buffer stop, only an OSS is provided. The two transmitters are either permanently energised or energised to coincide with the passing of a train on the line concerned. G 2.3.10 There are two sets of frequencies that can be used for transmitter loops. Each frequency set contains three separate frequencies; one is for use as the OSS arming frequency, one for the TSS arming frequency, and one for use as the trigger frequency for both OSS and TSS. G 2.3.11 Either frequency set can be used for either direction of operation, and there is no specific allocation of different frequency sets for up and down directions. G 2.3.12 Any pair of transmitters which constitute either a TSS or an OSS only initiate an automatic brake application if the train receives both the correct frequencies in the correct order. This allows trains to operate in both directions along the same line and avoids unwanted interventions when trains operate in the opposite direction along the same line. G 2.3.13 It is possible to use the other pair of frequencies, at the same location, for the opposite direction of travel, and the track transmitters for the two directions may be interleaved if necessary. Any valid pair of frequencies, detected in the correct order, should be correctly interpreted in this situation.

Page 12 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Part 3 Trackside Subsystem Requirements

3.1 Requirements for trackside AWS equipment

3.1.1 Lines to be fitted

3.1.1.1 Lines to be fitted with AWS 3.1.1.1.1 AWS shall be fitted on all signalled lines, except those where an alternative train protection system providing a level of protection equivalent to or better than that provided by AWS and TPWS is fitted and operational on the infrastructure and on all trains operating on the route.

Rationale G 3.1.1.1.2 AWS is a warning system used to mitigate the risk from signals passed at danger (SPAD) and from overspeed, where an alternative system is not used.

Guidance G 3.1.1.1.3 AWS (together with TPWS) is the standard system which is installed throughout the national network, except where there is an alternative system which provides an equivalent level of protection. Such alternative systems include ATP, ETCS and mechanical trainstops. G 3.1.1.1.4 There have been some exceptions to the fitment of AWS, which are covered by derogations. See the standards catalogue for further details of derogations which were made against historic issues of GERT8075 and GERT8035.

3.1.2 Equipment to be provided

3.1.2.1 Signals at which AWS is fitted 3.1.2.1.1 On fitted lines, AWS equipment shall be provided at signals in accordance with Table 1, except where AWS gaps are permitted by the provisions set out in 3.1.4.

RSSB Page 13 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Type of signal at which AWS shall be Exemptions from fitment fitted

All colour light signals a) Signals that have no main signalled route leading up to them (including the platform starting signal nearest to the buffer stops on bay and terminal platform lines and signals provided solely for turnback moves). b) Signals that give access to running lines from non-running lines where: i) Trains usually come to a stand, and ii) Trap points are provided to protect the running line(s). c) A colour light stop signal in a block signalling area where: i) The stop signals controlled by adjacent signal boxes are not fitted with AWS track equipment, and either ii) This signal cannot display a cautionary aspect, or iii) If the signal displays a cautionary aspect when the signal ahead is at danger, this aspect is approach released and preceded by a distant signal displaying an ON aspect. This exemption from fitment does not apply, however, where a colour light signal controls entry to a single line. In these circumstances AWS track equipment shall be provided unless the signal is exempt under (a) above

All semaphore distant signals and distant None boards

Table 1: Provision of AWS at signals

Page 14 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale - fitment at colour light signals G 3.1.2.1.2 AWS is normally provided at all colour light signals, whether or not they can display a cautionary aspect. G 3.1.2.1.3 The green aspect at a two aspect (red / green) colour light signal is identical to that given by a two-aspect distant (yellow / green) signal or by a three or four aspect signal, and it is less confusing to drivers to give the same AWS indication in all cases.

Rationale - exceptions to fitment G 3.1.2.1.4 Platform starting signals on bay and terminal platform lines are not provided with AWS because in many cases trains will be standing close to the signal before departure and would not pass over an AWS magnet if one was provided. G 3.1.2.1.5 Signals provided for turnback moves are applicable only to moves in the opposite direction to the normal direction of operation on the line. Such signals can be approached by unsignalled movements, but there is no requirement to provide AWS for unsignalled movements. If AWS were provided at turnback signals, it would need to be suppressed for normal direction movements. As the movements approaching the signal are not signalled routes, there is no practicable way to control the removal of suppression for these movements. G 3.1.2.1.6 At the exit from a non-running line (such as a siding) onto a running line, there may often be trap points to prevent trains entering the main line when the route is not set. The trap points provide alternative protection for the main line, and fitment of AWS approaching the exit signal is not necessary. G 3.1.2.1.7 Where a ‘semaphore equivalent’ aspect sequence applies on a non-track circuit block line, a train always receives a cautionary aspect at the distant signal if it is not possible to clear all the stop signals controlled from a signal box. AWS at the distant signal provides the necessary warning to the driver if the train does not have a clear MA through all the associated stop signals, and in these circumstances it is not necessary to provide AWS at the stop signals.

Rationale - fitment at semaphore signals G 3.1.2.1.8 For semaphore signals, AWS is normally provided only at distant signals, as it is apparent that a semaphore stop signal or stop board cannot display a cautionary aspect and the driver will not expect an AWS indication at such signals.

Guidance G 3.1.2.1.9 No guidance.

3.1.2.2 Provision of AWS trackside equipment on bi-directional lines 3.1.2.2.1 On bi-directionally signalled lines, AWS track equipment shall be provided for signalled train movements in both directions.

Rationale G 3.1.2.2.2 AWS is provided for all signalled movements authorised by main signals. On a section of track where main signalled movements apply in both directions, AWS track RSSB Page 15 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

equipment is provided to give appropriate AWS indications to drivers for movements in each direction.

Guidance G 3.1.2.2.3 No guidance.

3.1.2.3 Provision of suppressed AWS 3.1.2.3.1 Where AWS is required to be suppressed, a suppressor magnet shall be provided instead of the permanent magnet.

Rationale G 3.1.2.3.2 A suppressor magnet is capable of generating a magnetic field that cancels out the magnetic field of the permanent magnet and therefore inhibits the AWS warning (or any other indication) being given to the driver.

Guidance G 3.1.2.3.3 A suppressor magnet includes a permanent south pole and a suppressor coil. When the suppressor coil is energised, the magnetic field resulting from the combined effect of the permanent magnet and the suppressor coil is reduced to a level below the minimum level that can be detected by an AWS receiver. G 3.1.2.3.4 A suppressor magnet is used in preference to an electromagnet generating a south pole only when it is needed because, in failure conditions, an electromagnetic south pole could fail to generate a magnetic field and therefore fail to provide the required warning. With a suppressor magnet, if the power supply or the suppression coil fails, it defaults to an effective permanent south pole.

3.1.3 Position of equipment

3.1.3.1 Location of AWS track equipment on approach to the associated infrastructure 3.1.3.1.1 AWS track equipment shall be positioned 180 m (+ 18 m, - 9 m) before the associated signal or sign, except where any of the following apply: a) On a section of line where existing AWS track equipment at successive signals is positioned 230 m (+ 23 m, - 11.5 m) before signals, it is permissible for new AWS track equipment also to be positioned at this distance, provided that this does not create additional risk. b) On bi-directionally signalled platform lines, it is permissible to position AWS track equipment at distances other than those specified above where common AWS track equipment is provided for signals applying in opposite directions, in order to achieve correct operation of the equipment for train movements. c) Where the AWS magnet is positioned less than 180 m from the signal or sign so that the driver is able to read the associated signal aspect or sign when the audible warning is received. d) On a non-passenger line on which permissive working is authorised, the AWS track equipment may be positioned beyond, but as close as practicable to, the signal.

Page 16 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

e) Where infrastructure constraints prevent the installation of AWS equipment at the standard position. f) Where an alternative position is required to meet the constraints set out in 3.1.3.2. g) Where the AWS magnet is positioned beyond the signal in the circumstances set out as arrangement a) in 3.1.3.5. h) Where a signal sighting committee (SSC) recommends an alternative position and this achieves a reduction in risk.

Rationale (general) G 3.1.3.1.2 A consistent distance between the AWS magnet and the applicable signal or sign helps drivers to reliably identify which signal or sign the warning applies to, and, in the case of approaching a signal at danger, to judge their stopping position. G 3.1.3.1.3 A distance of 180 m (originally specified as 200 yards) gives the driver at least 2 s to read the applicable signal or sign at speeds up to 200 km/h (125 mph). G 3.1.3.1.4 The permitted tolerance (which is +10%, –5% of the nominal distance of 180 m) allows the position of the AWS magnet to be adjusted to meet site specific constraints without significantly altering the relationship between the magnet and the signal or sign as perceived by the driver.

Guidance (general) G 3.1.3.1.5 The position of AWS magnets potentially influences signal overrun risk and driveability. The signal overrun risk assessment process is set out in RIS-0386-CCS. Further guidance on driveability assessment is given in RIS-0713-CCS.

Rationale for a) G 3.1.3.1.6 The permitted tolerance (which is +10%, –5% of the nominal distance of 230 m) allows the position of the AWS magnet to be adjusted to meet site specific constraints without significantly altering the relationship between the magnet and the signal or sign as perceived by the driver.

Guidance on a) G 3.1.3.1.7 GERT8035 issue one required AWS magnets to be positioned 230 m from the signal on higher speed lines (where the permissible speed was more than 100 mph) to provide additional time for the driver to observe the signal after receiving the AWS indication. This requirement was withdrawn because it led to other inconsistencies, for example where there were parallel fast and slow lines with a speed exceeding 100 mph on the fast line and 100 mph or less on the slow line, requiring the magnets to be positioned at different distances from parallel signals. G 3.1.3.1.8 In terms of equipment response, the increased distance was not necessary provided the caution acknowledgement delay period was limited to 2 s, as a distance of 180 m allows sufficient time for the initial delay period and the caution acknowledgement delay period to elapse before the train passes the signal at a speed of 125 mph. G 3.1.3.1.9 Where a series of AWS magnets are installed at a distance of 230 m from consecutive signals, it might be preferable to maintain this distance, for consistency, within the

RSSB Page 17 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

localised area when additions or modifications are made to the existing signalling arrangements.

Rationale for b) G The use of a single set of magnets, for both directions of traffic, applying to the 3.1.3.1.10 signals at either end of the platform, is a practicable method of providing correct operation of AWS for all trains without needing complex suppression controls, particularly in platforms when permissive working and joining and splitting of trains takes place. G Most platforms are less than 360 m in length, so a bi-directional arrangement with a 3.1.3.1.11 shared magnet will require the AWS track equipment to be less than 180 m from one or both of the signals.

Guidance on b) G The minimum distance from the AWS magnet to the signal is limited by the specified 3.1.3.1.12 minimum running time of 3 s set out in GERT8075. This equates to 40 m at 30 mph or 80 m at 60 mph. G Where speeds in both directions are low, and most trains stop in the station, it will 3.1.3.1.13 often be appropriate to position the AWS magnets in the middle of the platform, the same distance from both signals. G It may be appropriate to position the AWS magnets at a greater distance from the 3.1.3.1.14 signal applying to normal direction movements (at or nearer to the standard distance of 180 m) and at a reduced distance from the opposite direction signal where: a) There is a designated normal direction of operation on the line through the platform, b) Speeds in the normal direction are high or a significant number of trains run through the station without stopping. c) The speed for movements in the opposite direction is lower and most trains using the platform line in that direction will stop at the station.

Rationale for c) G It is desirable to position AWS magnets so that the driver can see and interpret the 3.1.3.1.15 applicable signal aspect or sign at the time that the AWS warning is received.

Guidance on c) G In cases where the visibility of the signal or sign is restricted, there are two 3.1.3.1.16 approaches to positioning the AWS track equipment: a) Position the AWS magnet at the standard distance (180 m) from the signal, accepting that the signal will not be visible to the driver when the warning is received, or b) Position the magnet closer to the signal (subject to the minimum of 3 s running time set out in GERT8075), so that the signal is visible when the warning is received.

Page 18 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

G The preferred arrangement is for the associated signal or sign to be visible to the 3.1.3.1.17 driver when the AWS audible indication is received, so that the AWS indication can be readily associated with the appropriate item of lineside equipment which the driver is required to observe.

Rationale for d) G Positioning the AWS beyond the exit signal on a permissively worked freight line 3.1.3.1.18 avoids the possibility that the driver of a train which has entered an occupied section under a permissive movement authority will receive a clear AWS indication when the exit signal is displaying a green aspect for a preceding train which is between the AWS magnet and the signal.

Guidance on d) G If positioning the AWS beyond the exit signal is not adopted, complex controls may 3.1.3.1.19 be required to prevent the AWS giving a clear indication in these circumstances.

Rationale for e) G At some locations, features of the infrastructure, such as bridge decks, pointwork or 3.1.3.1.20 other obstructions, may make it impossible to install AWS track equipment at the preferred position. In such cases an alternative position is used.

Rationale for f) G 3.1.3.2 identifies a number of situations which might prevent AWS track equipment 3.1.3.1.21 from being placed in the preferred position.

Guidance on e) and f) G If the AWS track equipment cannot be placed at its preferred location, generally 180 3.1.3.1.22 m (+ 18 m, – 9 m) from the signal, due to one of these constraints, and it is not possible to relocate the item of equipment which gives rise to this constraint, the AWS equipment is moved to an alternative position. G It is generally better to place the signal in its optimum position and locate the AWS 3.1.3.1.23 equipment at a non-standard distance from the signal, rather than moving the signal to a less advantageous position so that the AWS can be placed at the standard distance from it.

Rationale for g) G Where AWS is fitted at a signal controlling train movements from a through running 3.1.3.1.24 line not fitted with AWS track equipment to a running line that is fitted, section a) requires the AWS track equipment to be positioned beyond the signal so that it can be suppressed for a train routed along the unfitted line, but it will be effective for a train routed to the fitted line.

Rationale for h) G A signal sighting committee may identify specific local factors which mean that 3.1.3.1.25 driveability could be improved by positioning the AWS magnet at a distance other than the standard distance from the signal or sign. RSSB Page 19 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Guidance on h) G In recommending an alternative position for the AWS magnet, the SSC should 3.1.3.1.26 consider the factors set out in RIS-0737-CCS (signal sighting assessment requirements). G The reasons for recommending an alternative position of an AWS magnet should be 3.1.3.1.27 recorded on the signal sighting form.

3.1.3.2 Positions where AWS track equipment is not sited 3.1.3.2.1 AWS equipment shall not be positioned: a) Where a train is likely to come to a stand with the receiver for the active driving position over the AWS track equipment. b) Within 4 s travelling time of any other AWS track equipment (calculated at the permissible speed), except where one or other of the sets of equipment is always suppressed for any movement over them. c) Where AWS equipment could interfere with the correct operation of Automatic Power Control (APC) equipment, or vice versa. d) Where the correct operation of the AWS track equipment could be jeopardised by the proximity of DC traction cables or impedance bonds. Specifically, on DC electrified lines, AWS track equipment shall not be positioned: i) Less than 3.5 m from cross-track traction feeder cables, traction return bonds or impedance bonds. ii) Less than 1.5 s travelling time (measured at the permissible speed) before cross-track traction feeder cables, traction return bonds or impedance bonds.

Rationale for a) G 3.1.3.2.2 If a train comes to a stand with the active AWS receiver over AWS track equipment, it might not be possible to acknowledge the AWS warning or release the brakes except by isolating the trainborne equipment.

Rationale for b) G 3.1.3.2.3 Placing two sets of AWS track equipment within 4 s travelling time of each other could result in the response of the trainborne AWS equipment to the first set of track equipment, including the time to reset the receiver following acknowledgement of a warning, masking its response to the second set.

Rationale for c) G 3.1.3.2.4 APC equipment uses magnets similar to AWS magnets but positioned each side of the track, with receivers mounted on the side of the vehicle.

Guidance on c) G 3.1.3.2.5 In junction areas, care should be taken in positioning AWS and APC track equipment so that the receiver of one system does not inadvertently detect the field from the magnets provided for the other system, leading to unwanted responses.

Page 20 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale for d) G 3.1.3.2.6 AWS track equipment is positioned far enough from DC electric traction supply equipment to avoid the magnetic field of the AWS magnet being distorted or suppressed by magnetic fields emitted by the other equipment. G 3.1.3.2.7 AWS is positioned far enough from cross-track traction feeder cables, traction return bonds or impedance bonds to reduce the potential for incorrect AWS indications caused by stray magnetic fields. G 3.1.3.2.8 The magnetic field from DC electric traction supply equipment could generate a north pole which could be detected by the AWS receiver on the train. If AWS track equipment is positioned less than 1.5 s running time from DC traction equipment, a north pole from the traction equipment could be received after the train has correctly detected a south pole from the AWS magnet and cause a false ‘clear’ AWS indication when a warning should be given.

3.1.3.3 Agreement of AWS track equipment position by SSC 3.1.3.3.1 The position of the AWS track equipment shall be agreed by a SSC where either: a) The distance of the track equipment from the signal or sign is other than 180 m (+ 18 m, - 9 m), or b) The AWS audible indication is received by the driver before the signal or sign becomes visible.

Rationale G 3.1.3.3.2 The signal sighting process is used to confirm that lineside signals and signs are adequately visible and readable. This process should take account of the contribution of the AWS to readability and the effectiveness of the warning which it provides.

Guidance G 3.1.3.3.3 AWS track equipment is preferably positioned to meet two conditions – a standard distance of 180 m from the associated signal or sign, and visibility of the signal or sign when the warning is received. G 3.1.3.3.4 These conditions are intended to provide a consistent and effective warning to drivers. Where it is not possible to achieve these conditions, the effectiveness of the AWS warning to the driver could be reduced. G 3.1.3.3.5 There are circumstances where the AWS track equipment may be positioned so that the audible indication is received before the signal is visible to the driver, provided that the time interval between receiving the AWS indication and seeing the signal is not excessive. G 3.1.3.3.6 Further guidance on AWS within the signal sighting assessment process is set out in RIS-0737-CCS.

RSSB Page 21 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

3.1.3.4 Infrastructure features that cannot be positioned between signals or signs and their associated AWS track equipment 3.1.3.4.1 The following infrastructure features shall not be positioned between a signal or sign and its associated AWS track equipment: a) Another main signal applicable to movements in the same direction. b) A warning indicator for a reduction in permissible speed. c) A warning board for a temporary or emergency speed restriction. d) Other AWS equipment applicable to movements in the same direction.

Rationale G 3.1.3.4.2 When a driver receives an AWS indication, there should be no potential for confusion as to which item of signalling equipment the AWS indication relates.

Guidance G 3.1.3.4.3 In order to avoid confusion in relating an AWS indication to the equipment for which it is intended to give a warning, the signal or sign to which the AWS indication applies should be clearly identifiable by the driver. Therefore, no other items of equipment which could be associated with an AWS indication should be positioned between an AWS magnet and the signal or sign to which it applies.

3.1.3.5 AWS for controlling movements from a line not fitted with AWS to a fitted line 3.1.3.5.1 Where a signal controls train movements from a running line not fitted with AWS track equipment to a running line that is fitted, one of the following arrangements shall apply: a) Where there is a turnout from a through running line not fitted with AWS onto an AWS fitted line, AWS track equipment shall be provided for the stop signal controlling the movement onto the fitted line. The track equipment shall incorporate provision for suppression, and shall be positioned beyond, but as close as practicable to, the signal. The signals that display cautionary aspects associated with the stop signal shall not be fitted with AWS, or b) Where a running line not fitted with AWS converges with an AWS fitted line, the stop signal controlling movements from the unfitted line to the fitted line and any associated signals displaying cautionary aspects shall be fitted with AWS track equipment in accordance with the requirements set out in GERT8075.

Rationale G 3.1.3.5.2 Trains running onto a line fitted with AWS should receive an AWS indication at the signal that controls the movement onto the fitted line. Trains continuing along the unfitted line are not given an AWS indication, as it would be inconsistent to present a single AWS indication to the driver travelling along an otherwise unfitted line. G 3.1.3.5.3 So that the AWS magnet can be appropriately controlled where the situation in a) applies (that is, it is suppressed for a train routed along the unfitted line but active for a train routed to the fitted line), it is located beyond the signal so that the routing of the train is known at the time it passes over the magnet. If the magnet was located Page 22 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

before the signal, and a train approached the signal when no route had been set, it would not be possible to determine the route that the train was to take. G 3.1.3.5.4 Where an unfitted line leads only onto an AWS fitted line as in situation b), normal AWS indications are provided at the signals approaching the convergence as it will always be appropriate for the train to receive them.

Guidance G 3.1.3.5.5 The situation in a) above will not arise if all lines are fitted with AWS, but there may still be some locations where a through goods line running parallel to a passenger line has not been fitted.

3.1.4 AWS Gap Areas

3.1.4.1 Retention of AWS gap areas during resignalling 3.1.4.1.1 When an existing signalling layout incorporating an AWS gap area (a station area not fitted with AWS track equipment) is resignalled, AWS track equipment shall be provided, unless both of the following apply: a) Permissible speeds in the unfitted area do not exceed 50 km/h (30 mph), and b) A risk assessment shows that absence of AWS track equipment within the gap area does not introduce an unacceptable risk.

Rationale G 3.1.4.1.2 Low permissible speeds reduce the level of collision risk. G 3.1.4.1.3 Non-provision of AWS in a gap area represents a reduction in the level of train protection generally provided, and AWS gaps should only be retained where the absence of this provision can be justified.

Guidance G 3.1.4.1.4 No guidance.

3.1.4.2 Identification of AWS gap areas 3.1.4.2.1 The geographical limits of an AWS gap shall be clearly identifiable. 3.1.4.2.2 Lineside signs shall be provided to indicate the commencement and termination of the AWS gap on all running lines that provide entry to or exit from the gap area as follows: a) A ‘commencement of AWS gap’ lineside sign shall be provided at or beyond the last fitted signal and before the position where the AWS track equipment for the next signal would have been, had it been provided, and b) A ‘termination of AWS gap’ sign shall be provided beyond the last signal not fitted with AWS and not less than 4 s travelling time at the permissible speed before the AWS track equipment for the first fitted signal.

RSSB Page 23 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Rationale G 3.1.4.2.3 Areas where AWS is not provided should be easily identifiable by train drivers. G 3.1.4.2.4 Lineside signs are provided to remind the driver of the extent of the AWS gap and to avoid any confusion over where AWS indications should be received and where they are not provided.

Guidance G 3.1.4.2.5 The Sectional Appendix sets out information on the location of AWS gap areas. G 3.1.4.2.6 The design of lineside signs is specified in the online catalogue of lineside signs which is indexed in GIGN7634. G 3.1.4.2.7 The 'commencement of AWS gap' and 'termination of AWS gap' signs are provided where there is a short gap in AWS fitment on a line that is otherwise fitted, and are distinct from the signs for ‘commencement of AWS’ and ‘termination of AWS’ used at the transition to and from areas with other types of train protection.

3.1.5 Control of AWS track equipment

3.1.5.1 Energisation of AWS electromagnets 3.1.5.1.1 The AWS electromagnet shall be energised only when the associated colour light signal is displaying a green aspect, or when the associated semaphore distant signal is intentionally displaying the OFF aspect. 3.1.5.1.2 In the case of a splitting distant signal, the AWS electromagnet shall be energised if either signal colour light head is displaying a green aspect.

Rationale G 3.1.5.1.3 AWS gives a clear indication (bell) to the driver when the energised electromagnet (north pole) is detected by the AWS receiver. A clear indication is given only when a signal is displaying a clear aspect (colour light signal showing green or semaphore distant OFF). Giving an AWS clear indication in combination with any other signal aspect would be misleading to the driver. G 3.1.5.1.4 At a splitting distant signal, a clear AWS indication is given when the signal is cleared for either route so that the AWS indication is consistent with the green aspect displayed by the signal.

Guidance G 3.1.5.1.5 No guidance.

3.1.5.2 Control of AWS equipment positioned beyond signals 3.1.5.2.1 Where an AWS magnet is positioned beyond the signal, as set out in situation d), the AWS track equipment shall be controlled to provide an indication that is consistent with the aspect seen by the driver at the time of passing the signal.

Page 24 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale G 3.1.5.2.2 Where the AWS magnet is located beyond the signal, the AWS indication presented to the driver corresponds to the state of the signal seen by the driver before the train passes the signal.

Guidance G 3.1.5.2.3 This may be achieved by delaying the replacement of the signal to danger until after the train has passed over the AWS magnet, where this can be done without introducing other risks. G 3.1.5.2.4 Where it is not reasonably practicable or desirable to delay the replacement of the signal, the control of the AWS magnet should correspond to the aspect displayed by the signal before it was replaced to danger.

3.1.5.3 Control of AWS equipment between fitted and unfitted lines 3.1.5.3.1 Where a suppressed AWS magnet is situated beyond the signal protecting a turnout from a through unfitted line, as set out in case a) in 3.1.3.5.1, the magnet shall be suppressed for movements along the unfitted line. 3.1.5.3.2 For movements through the turnout onto the fitted line, the AWS track equipment shall be controlled to provide an indication that is consistent with the aspect seen by the driver at the time of passing the signal controlling the movement onto the fitted line.

Rationale G 3.1.5.3.3 For a train running along the unfitted line, the AWS magnet is suppressed so that the driver does not receive an AWS indication, which would give an inconsistent presentation to the driver travelling along an otherwise unfitted line. G 3.1.5.3.4 When the train is joining a line fitted with AWS, the magnet provides an appropriate AWS indication to the driver.

Guidance G 3.1.5.3.5 Where the AWS magnet for movements onto the fitted line is located beyond the signal, the AWS indication presented to the driver reflects the state of the signal seen by the driver before the train passes the signal. G 3.1.5.3.6 This may be achieved by delaying the replacement of the signal to danger until after the train has passed over the AWS magnet, where this can be done without introducing other risks. G 3.1.5.3.7 Where it is not reasonably practicable or desirable to delay the replacement of the signal, the control of the AWS magnet should correspond to the aspect displayed by the signal before it was replaced to danger.

RSSB Page 25 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

3.1.6 Suppression of AWS track equipment

3.1.6.1 Application of AWS suppression 3.1.6.1.1 On bi-directionally signalled lines, except where AWS track equipment is effective for movements in both directions, the magnetic field of the AWS track equipment shall be suppressed for signalled movements in the direction to which the equipment does not apply, except as permitted by 3.1.6.4 and 3.1.6.5.

Rationale G 3.1.6.1.2 On a single / bi-directional line, where an AWS indication is applicable only in one direction of travel, suppression of the AWS magnet prevents the driver receiving an inappropriate AWS indication when the train is passing over the equipment in the opposite direction.

Guidance G 3.1.6.1.3 GERT8075 and item b) of 3.1.3.1 describe the situation where a single set of AWS magnets is used to provide indications for trains in both directions, and in this case suppression is not required.

3.1.6.2 Operation of AWS suppression 3.1.6.2.1 Where suppression of an AWS magnet is required, it shall be effective from before the vehicle on which the AWS receiver for the active driving position is mounted has reached the AWS track equipment until that vehicle has passed over the AWS track equipment.

Rationale G 3.1.6.2.2 The magnet needs to be suppressed at the time that the AWS receiver passes over it.

Guidance G 3.1.6.2.3 In order to economise on power consumption of the trackside equipment, it is permissible for suppression to be removed as soon as the vehicle on which the receiver (for the active driving position) is mounted has passed over the AWS track equipment, rather than waiting for the whole train to pass clear. This may be particularly desirable for extra strength suppressor magnets because of their high- power consumption.

3.1.6.3 AWS suppression at semaphore junction signals 3.1.6.3.1 Where a semaphore junction signal has both stop and distant arms but the distant arm(s) are not applicable to all routes, the AWS equipment shall be suppressed when the signal is cleared for a route to which the distant arm(s) is / are not applicable.

Rationale G 3.1.6.3.2 This prevents the driver receiving an inappropriate AWS indication.

Page 26 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Guidance G 3.1.6.3.3 This situation will arise when a semaphore junction signal has distant arms for some of the routes from the signal but not for all of them. A driver does not receive an AWS indication when the signal is cleared for a route that is not associated with a distant signal arm. G 3.1.6.3.4 If no route from the signal has been cleared when a train passes over the AWS magnet, the magnet is not suppressed and the driver of a train approaching the signal at danger receives an AWS warning indication.

3.1.6.4 Exceptions from AWS suppression - impractical locations 3.1.6.4.1 It is permissible for AWS track equipment not to be suppressed for: a) Shunting movements on unidirectionally signalled lines. b) Unsignalled movements. c) Movements over AWS magnets associated with warning boards for temporary / emergency speed restrictions that are not applicable to the direction of movement.

Rationale G 3.1.6.4.2 It is not generally practicable to provide suppression for movements over the AWS equipment in the opposite direction in these cases. In these circumstances drivers will expect to receive AWS warnings that may not be applicable to the movement being made.

Guidance G 3.1.6.4.3 No guidance.

3.1.6.5 Exceptions from AWS suppression - lightly used lines 3.1.6.5.1 On lightly used single lines it is permissible for AWS track equipment not to be suppressed for movements in the direction to which the AWS indication does not apply where this is justified by a risk assessment.

Rationale G 3.1.6.5.2 At some locations on single lines it might not be cost effective to provide appropriate controls to suppress AWS magnets.

Guidance G 3.1.6.5.3 On track circuit block lines, it is normally practicable to provide and control suppression for AWS associated with signals at passing loops. In this case, non- provision of suppression is limited to intermediate locations within a signalling section, such as permissible speed warning indicators where provision and control of suppression may not be practicable. G 3.1.6.5.4 On lines worked by other block and token systems, it might not be practicable to provide and control suppression for AWS associated with signals. RSSB Page 27 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

G 3.1.6.5.5 Factors to be taken into account in the risk assessment include: a) Whether indications from unsuppressed AWS equipment could cause confusion to drivers in the vicinity of signals or signs that are applicable to the direction of movement. b) The level of overrun risk at a stop signal, particularly at a signal controlling the entrance to a section of single line where the driver might subconsciously ignore a valid AWS warning as a consequence of repetitively cancelling previous unsuppressed AWS warnings. c) The regular use of the line for special purposes such as driver training, where receipt of inapplicable indications from unsuppressed AWS equipment could have a particular impact on driver behaviour. G 3.1.6.5.6 For the purposes of this risk assessment, it has been the practice to consider a line which has no more than two train movements per hour as a ‘lightly used line’.

3.1.6.6 Consistency of the provision of AWS suppression 3.1.6.6.1 Provision or non-provision of suppression of AWS track equipment shall be applied consistently on all single line sections on an operating route.

Rationale G 3.1.6.6.2 Consistency in the application of AWS suppression helps drivers to identify the locations where they expect to receive inapplicable warnings, and thus reduces the risk that they will ignore applicable warnings.

Guidance G 3.1.6.6.3 Receiving inapplicable warnings from unsuppressed AWS equipment could create a risk that drivers become accustomed to ignoring AWS warnings and could also ignore warnings that do apply to them. G 3.1.6.6.4 Assessment of this risk forms part of the overall layout assessment process set out in RIS-0386-CCS.

3.1.7 AWS cancelling indicators

3.1.7.1 Provision of AWS cancelling indicators 3.1.7.1.1 Where AWS track equipment is not suppressed for signalled movements in the opposite direction, as permitted by 3.1.6.4 and 3.1.6.5, an AWS cancelling indicator shall be provided for each set of track equipment.

Rationale G 3.1.7.1.2 The AWS cancelling indicator is provided to remind the driver that the AWS warning which has been received is not applicable. Providing a sign to confirm that an AWS warning does not apply reduces the likelihood that a driver will mistakenly ignore an AWS warning that does apply thinking that it is not applicable.

Page 28 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Guidance G 3.1.7.1.3 Where trains pass over unsuppressed AWS magnets provided for trains travelling in the opposite direction, the driver receives an AWS warning which does not apply to that train. AWS cancelling indicators indicate to the driver that the AWS warning which has been received is not applicable to that train and may be cancelled (acknowledged with no need to take further action). G 3.1.7.1.4 The form of AWS cancelling indicators is specified in the online catalogue of lineside signs, which is indexed in GIGN7634. G 3.1.7.1.5 Requirements for the provision of cancelling indicators for temporary and emergency speed restriction AWS equipment are set out in GKRT0075.

3.1.7.2 Position of AWS cancelling indicators 3.1.7.2.1 The AWS cancelling indicator shall be positioned: a) 180 m (+ 18 m, - 9 m) beyond the AWS track equipment in the direction of movement to which the equipment does not apply, and b) Facing trains travelling in the direction to which the AWS track equipment does not apply.

Rationale G 3.1.7.2.2 The cancelling indicator is visible to the driver when the AWS warning is received, so that the driver can clearly identify that the AWS warning is not applicable.

Guidance G 3.1.7.2.3 The AWS cancelling indicator is positioned so that it is readable from the normal driving position when the train passes over the unsuppressed track equipment. The signal sighting assessment set out in RIS-0737-CCS is relevant to the position of all lineside signalling assets.

3.2 Requirements for trackside TPWS equipment

3.2.1 Provision of TPWS track equipment

3.2.1.1 Lines on which TPWS is provided 3.2.1.1.1 TPWS track sub-system equipment shall be provided on all passenger lines at the locations specified in 3.2.1.2, except where exemptions are permitted by 3.2.2.1 or 3.2.2.2.

Rationale G 3.2.1.1.2 TPWS is the default system provided to control the residual risk from SPAD and overspeeding that is not addressed by provision of AWS.

RSSB Page 29 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Guidance G 3.2.1.1.3 TPWS (together with AWS) is the standard train protection system which is installed throughout the national network, except where there is an alternative system which provides an equivalent level of protection.

3.2.1.2 Locations at which TPWS is provided 3.2.1.2.1 TPWS shall be provided at the following locations: a) On passenger lines at all main stop signals and stop boards that protect crossing or converging movements with any running line or siding. b) At any main stop signal on a non-passenger line that protects a crossing of, or convergence with, a passenger line. c) At a stop signal where conflicting movements could take place in the overlap of the next stop signal ahead. d) On non-track circuit block lines with a semaphore equivalent aspect sequence, at the first home signal at the end of a block section where conflicting movements could take place within station limits ahead e) On the approach to the buffer stop at the end of a passenger platform. f) On the approach to speed restrictions where the permitted speed on the approach is 60 mph or more and the speed restriction reduces the speed by at least one- third, except for: i) Temporary speed restrictions in place for three months or less, and ii) Temporary speed restrictions in place for between three months and twelve months, subject to risk assessment, as set out in 3.2.2.2.

Rationale for a) G 3.2.1.2.2 TPWS is provided at signals protecting conflicting movements because these are identified as locations where a SPAD presents a high risk.

Rationale for b) G 3.2.1.2.3 A non-passenger movement that could enter a passenger line without authority presents a risk to authorised movements of passenger trains.

Rationale for c) G 3.2.1.2.4 If it is not possible for TPWS at the following signal to stop a movement before it reaches a potential point of conflict beyond that signal, TPWS protection is provided at the previous signal.

Rationale for d) G 3.2.1.2.5 On lines where a semaphore-type aspect sequence applies, a train is stopped, or brought nearly to a stand, at the first home signal if there is any conflicting movement preventing the signals ahead from being cleared. TPWS at the first stop signal therefore protects any conflicting movement within station limits.

Page 30 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale for e) G 3.2.1.2.6 Buffer stop collisions are an additional area of risk that TPWS has been designed to mitigate.

Rationale for f) G 3.2.1.2.7 Derailment due to overspeed at speed restrictions was identified as an additional risk that TPWS was designed to protect. G 3.2.1.2.8 The criteria previously established for determining whether a speed reduction is protected by AWS are also applied to determine the requirement for TPWS protection. G 3.2.1.2.9 While temporary speed restrictions are protected by AWS, there are practical difficulties in applying TPWS protection on a temporary basis. The Railway Safety Regulations 1999 stated that temporary speed restrictions would not require TPWS protection; however, these regulations define a temporary speed restriction as one that is in place for three months or less.

Guidance on f) G In practice, temporary speed restrictions are often in place for more than three 3.2.1.2.10 months. The requirements for provision of TPWS at temporary speed restrictions which are in place for between three months and twelve months are set out in 3.2.2.2.

3.2.2 Exemptions to provision of TPWS track equipment

3.2.2.1 Locations exempt from TPWS fitment 3.2.2.1.1 The TPWS track sub-system is not required to be provided in the circumstances set out below: a) Where an alternative train protection system providing a level of protection equivalent to or better than AWS and TPWS is fitted and operational on the infrastructure and on all trains operating on the route. b) At a signal used solely for shunting purposes. c) At a stop signal that protects only a convergence of a passenger running line with a locally operated emergency crossover. d) At a stop signal that protects a crossing or convergence with a passenger running line, where the track layout and interlocking controls would prevent a collision at the crossing or convergence in the event of a SPAD. e) At a stop signal that protects only a convergence with a siding that is secured out of use in accordance with GERT8000. f) Where a permissible speed indicator is provided to indicate a permissible speed that has been imposed solely to reduce the dynamic loading on track systems from rail traffic. g) Where the attainable speed on entry to the commencement of a speed restriction is less than 60 mph, or less than the excessive speed defined for the section of track.

RSSB Page 31 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

h) Where a permissible speed indicator is provided on the approach to a diverging junction where the risk from overspeeding on the diverging route is mitigated by approach control of the signalling.

Rationale for a) G 3.2.2.1.2 TPWS does not need to be provided where an alternative train protection system provides an equivalent or higher level of protection for all trains using the route.

Rationale for b) G 3.2.2.1.3 TPWS is not provided for shunting movements because the slow speed of the movement reduces the level of risk.

Rationale for c) G 3.2.2.1.4 TPWS is not provided for protection of an emergency crossover which is infrequently used and where the local control arrangements will limit the impact of irregular operation.

Rationale for d) G 3.2.2.1.5 TPWS does not need to be provided where a train which passes a signal at danger will be diverted by trap points or similar layout configurations and will not reach a point of conflict with a train passing on the protected line.

Rationale for e) G 3.2.2.1.6 TPWS is not provided for protection of a siding which is secured out of use and which can only be used infrequently under local control arrangements.

Rationale for f) G 3.2.2.1.7 A speed restriction may be imposed to reduce the loading on the track, but where this is the only reason for the speed restriction there is no risk from derailment due to overspeeding.

Rationale for g) G 3.2.2.1.8 The risk from overspeeding at a speed restriction is related to the maximum attainable speed of trains, which may be less than the permissible speed.

Rationale for h) G 3.2.2.1.9 Approach release of a junction signal for a diverging route enforces a speed reduction on approaching trains through the signal aspects, and this provides an alternative method of controlling the risk from overspeeding.

Guidance G No guidance. 3.2.2.1.10

Page 32 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

3.2.2.2 Locations that may be exempt from TPWS fitment 3.2.2.2.1 In the circumstances set out below, the TPWS track sub-system need be fitted only where the results of a risk assessment show that the fitment of TPWS is justified in order to reduce risk so far as reasonably practicable: a) On the approach to a permissible speed indicator where, in order to prevent unwarranted emergency brake applications on freight trains passing over the TPWS OSS, the position of the OSS would have to be adjusted such that it would provide no protection to any trains. b) On the approach to a permissible speed indicator solely associated with a plain line curve where there is a potential risk from derailment or overturning. c) Where a permissible speed indicator is provided to indicate a permissible speed that has been imposed solely to protect trains from the infrastructure or other passing trains due to limited clearance. d) Where a permissible speed indicator is provided on the approach to a footpath or bridleway level crossing for the sole purpose of increasing the warning time for crossing users. e) For temporary speed restrictions that are planned to be in place for between three and twelve months.

Rationale for a) G 3.2.2.2.2 In some locations it is not possible to provide OSS protection for a speed restriction that will be effective in preventing overspeed risk for one category of train without the likelihood that it will cause unwarranted interventions for other types of train.

Guidance on a) G 3.2.2.2.3 These circumstances can arise because the different trigger delay timer settings for passenger and freight trains, which lead to different interpretations of the set speed of an OSS loop, are optimised for the speed profiles of trains braking to a stand. Therefore they might not correctly reflect the difference in the speed profiles of passenger and freight trains on the approach to a speed restriction, which might also be influenced by a lower approach speed for freight trains or different permissible speeds at the speed restriction for different types of train.

Rationale for b) G 3.2.2.2.4 At some locations on the approach to a curve, even though the reduction in permissible speed meets the criteria requiring provision of TPWS, the potential for a train derailing or overturning on the curve is very low.

Rationale for c) G 3.2.2.2.5 Speed restrictions are imposed as a mitigating measure where clearances between trains and infrastructure or between passing trains are limited, but the risk from actual contact is small.

RSSB Page 33 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Rationale for d) G 3.2.2.2.6 A speed restriction can be imposed to provide the required minimum warning time for crossing users, but, while there may be a risk to individual crossing users, the overall risk to the train from excessive speed is small.

Rationale for e) G 3.2.2.2.7 Derailment due to overspeed at speed restrictions was identified as an additional residual risk that TPWS should be designed to protect, but it might not be practicable to provide TPWS at temporary speed restrictions.

Guidance on e) G 3.2.2.2.8 Although the Railway Safety Regulations 1999 exempted temporary speed restrictions from the requirement for TPWS protection, these regulations define a temporary speed restriction as one that is in place for three months or less. G 3.2.2.2.9 In practice, temporary speed restrictions are often in place for more than three months. Any speed restriction that comes within the TPWS fitment criteria and is in place for more than three months would therefore require TPWS to be provided. An exemption was granted to the Railway Safety Regulations permitting TPWS not to be provided at a temporary speed restriction in place for up to 12 months if this does not create excessive risk.

3.2.2.3 Permitted disconnection of trackside TPWS equipment 3.2.2.3.1 The TPWS track sub-system is not required to be operational in the circumstances set out below: a) When the track sub-system is to be disconnected, removed, replaced or repositioned in accordance with engineering protection or possession arrangements, as set out in the Rule Book, and b) When the track sub-system is to be disconnected to facilitate other work, provided that permission to disconnect has been obtained in accordance with the Rule Book.

Rationale G 3.2.2.3.2 The Railway Safety Regulations did not allow for disconnection or temporary removal of TPWS track equipment during possessions or other work; an exemption was granted to allow this.

Guidance G 3.2.2.3.3 No guidance.

3.2.3 Positioning of trackside TPWS OSS equipment

3.2.3.1 Positioning of trackside TPWS OSS equipment 3.2.3.1.1 OSS transmitters shall be positioned to optimise their safety benefits, taking account of:

Page 34 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

a) The braking performance of trains, as set out in GMRT2045. b) The attainable speeds of trains on the approach to the signal or other location. c) The distance from the stop signal to the point of conflict at the crossing or convergence ahead. d) The gradient of the line on the approach to the signal or other location. e) The interleaving of other location OSS functions where signal OSS and TSS functions are, or will be, installed. f) The potential for inhibition of the vehicle TPWS self-test on power-up. g) The potential for unwarranted intervention during movements in the opposite direction on bi-directional or reversible lines.

Rationale G 3.2.3.1.2 TPWS is not always able to provide fully effective protection for all trains approaching at speeds up to the maximum permissible speed of the line. Initial development of TPWS was based on an assumed braking rate of 12%g for passenger trains, but not all trains can achieve this. G 3.2.3.1.3 Item f) is included because a vehicle fitted with older designs of TPWS equipment that is powered up while standing over a TPWS transmitter may be unable to complete the TPWS self-test due to the presence of the frequency transmitted by the loop. Positioning of transmitters should therefore, as far as practicable, avoid placing loops where trains may stand with their receiver over the loop, shut down and start up again (including locations where drivers may need to change cabs or where trains may be split).

Guidance G 3.2.3.1.4 To improve the effectiveness over a wider range of speeds, additional loops can be provided, but the provision of more than two OSS loops (‘standard’ and ‘TPWS+’) on the approach to any signal is rarely justifiable. G 3.2.3.1.5 The policy developed by the TPWS Strategy Group and approved by the RSSB Board in 2011 is: a) For new scheme designs, taking due account of future ERTMS fitment: i) Network Rail to continue to apply the design principle that calculates the number of loops necessary to protect 12%g trains, and then optimise the design on a site-by-site basis to maximise the protection provided by that number of loops, so that it provides better protection for lower braking rate trains that will continue to use the routes into the future. ii) Network Rail to use the development of the TPWS effectiveness calculator within the Signal Overrun Risk Assessment Tool (SORAT) process and apply it on a signal-by-signal basis to new scheme designs to determine if it would be reasonably practicable to implement an extra OSS loop based on the improvement in the effectiveness (and hence the potential safety benefit) it delivers. Network Rail will demonstrate to the TOCs that they have applied these principles when undertaking the joint review of signalling scheme plans prior to their final approval. RSSB Page 35 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

b) For existing signals, as part of Network Rail’s five-year review programme for each junction signal (prioritised based on the RSSB risk ranked list) and taking due account of future ERTMS fitment: i) Use the development of the TPWS effectiveness calculator within the SORAT process and apply it to determine if it would be reasonably practicable to implement an extra OSS loop based on the improvement in the effectiveness (and hence the potential safety benefit) it delivers.

3.2.3.2 Review of the position of trackside TPWS OSS equipment 3.2.3.2.1 The provision and positioning of the TPWS track sub-system shall be reviewed if a change to the infrastructure or the operational use of the railway is proposed which may affect the track layout, signal location, the attainable speed of trains, or the signal passed at danger (SPAD) risk.

Rationale G 3.2.3.2.2 Changes to any parameter can reduce the effectiveness of TPWS and may mean that previously determined positioning of track transmitters is no longer optimal.

Guidance G 3.2.3.2.3 This should also take account of changes to the characteristics of trains using the line, for example the replacement of trains which can achieve 12%g braking by trains with lower braking capability.

3.2.4 Magnetic field requirements for TPWS track equipment

3.2.4.1 Interleaving and nesting of TPWS trackside equipment 3.2.4.1.1 It is permissible to use either sequence of track transmitter frequencies to provide the appropriate function for either direction of operation. 3.2.4.1.2 It is permissible to interleave or nest TSS or OSS transmitters using one set of frequencies (set A or set B) with TSS or OSS transmitters of the other set of frequencies. TSS or OSS transmitters of the same frequency set shall not be interleaved or nested.

Rationale G 3.2.4.1.3 The use of alternative frequency sets and the ability to interleave and nest track transmitters gives the flexibility necessary to allow configurations of TPWS transmitters which provide appropriate information to control the speed of trains in the variety of circumstances that may arise in application of TPWS to track and signalling layouts.

Guidance G 3.2.4.1.4 The frequency sets are set out in GERT8075 as follows:

Page 36 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Frequency set Arming frequency Trigger frequency

OSS frequency set A 64.25 kHz (f1) 65.25 kHz (f2)

OSS frequency set B 64.75 kHz (f4) 65.75 kHz (f5)

Table 2: Track transmitter frequencies for overspeed protection functionality

Frequency set Arming frequency Trigger frequency

TSS frequency set A 66.25 kHz (f3) 65.25 kHz (f2)

TSS frequency set B 66.75 kHz (f6) 65.75 kHz (f5)

Table 3: Track transmitter frequencies for train stop functionality

The second set of frequencies was originally intended for use in the opposite direction on bi-directionally signalled track. However, it was realised that both sets of frequencies could be utilised in the same direction to enable multiple OSS and TSS installations to be more closely spaced than if restricted to a single set of frequencies. G 3.2.4.1.5 The use of alternative frequency sets and the possibility of interleaving and nesting track transmitters means that TPWS receivers need to be capable of correctly interpreting the various permitted arrangements.

3.2.5 Control of TPWS track equipment

3.2.5.1 Control of TPWS track transmitters associated with signals 3.2.5.1.1 The track transmitters associated with signals shall be energised when the signal is controlled to danger.

Rationale G 3.2.5.1.2 When a signal is at danger, all the associated TPWS loops (TSS and one or more OSS, if provided) are energised, so that the TPWS receiver on a train passing over them detects the transmitted signals and initiates an intervention if the train passes any of the OSS loops at excessive speed or if it passes the signal at danger and passes over the TSS.

Guidance G 3.2.5.1.3 When the signal is displaying any proceed aspect (main or subsidiary), the TPWS loops are de-energised and therefore a passing train will not receive any intervention from the TPWS. G 3.2.5.1.4 In some earlier installations, it was the practice to de-energise the TSS when a subsidiary aspect was cleared but keep the OSS energised. This was based on the assumption that a train approaching a cleared subsidiary aspect would not exceed the set speed at the OSS loops. However, in some cases it was found that trains RSSB Page 37 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

proceeding towards the cleared subsidiary aspect were tripped at the OSS loops, although their speed was not considered excessive. Therefore, the practice is now to de-energise all loops, including the OSS, when a subsidiary aspect is displayed. In many cases the approach release applied to a subsidiary aspect will not allow the aspect to clear until after the train has passed over the OSS. G 3.2.5.1.5 The infrastructure manager (IM) has arrangements in place to identify the failure of the TPWS track sub-system to transmit a magnetic field when it is required, so that an alternative safe system of working of trains can be implemented without undue delay. G 3.2.5.1.6 For TPWS fitted to signals, failures will normally be indicated to the signaller, and the means of notification of failure should generally be immediate and automatic. Where this is not practicable, for example at stop boards on Radio Electronic Token Block (RETB) lines, the notification may be by means of a TPWS failure indication to the driver.

3.2.5.2 Control of TPWS track transmitters associated with assets other than signals 3.2.5.2.1 The track transmitters provided at locations other than signals shall always be energised when a train is passing over the transmitter on the line concerned.

Rationale G 3.2.5.2.2 Intervention will always be required if a train exceeds the set speed at the OSS loops on the approach to an ‘other location’ (a speed restriction or buffer stops).

Guidance G 3.2.5.2.3 The loops at other locations may be permanently energised or, to economise on power supplies, may be energised only when a train is passing over them. G 3.2.5.2.4 In the case of TPWS transmitters at other locations, the IM determines the most appropriate method of failure notification.

Page 38 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Part 4 Trainborne Subsystem Requirements

4.1 Requirements for trainborne AWS equipment

4.1.1 Self-test capability of trainborne AWS equipment

4.1.1.1 AWS trainborne self-test routine 4.1.1.1.1 The trainborne AWS equipment shall have a built-in self-test routine which, as a minimum, tests the following features: a) That the audible and visual indications operate correctly when required to do so, and b) That an AWS brake demand is requested when required.

Rationale G 4.1.1.1.2 Because AWS is considered to be a primary safety system, the principal features of the trainborne system are tested for correct operation before the start of each journey to give assurance that the system is capable of providing effective protection for the train.

Guidance G 4.1.1.1.3 The self-test requirements set out in 5.7.1 only test the functionality of the system and the driver interface, and do not on their own confirm that the AWS receiver will actually detect track magnets.

4.1.1.2 Initiation of AWS power-up test routine 4.1.1.2.1 The AWS power-up test routine, as set out in 5.7.1, shall be initiated whenever the train is powered up or, in the case of dual cab trains, when the driver changes cab.

Rationale G 4.1.1.2.2 The test is carried out when a cab is brought into use. In the case of a dual-cab locomotive, although a single AWS receiver provides input to both cabs, the audible and visual indications are separate for each cab and are therefore tested separately when the driver changes ends.

Guidance G 4.1.1.2.3 Detailed requirements for the power-up test and the layout and functionality of the DMI are set out in Part 5.

4.1.1.3 AWS self-test following transition 4.1.1.3.1 An AWS self-test routine shall be conducted automatically when a train enters a portion of line where the trainborne AWS equipment is required to be active, having previously been suppressed, unless monitoring the AWS trainborne subsystem while it is in the suppressed state provides an equivalent level of confidence in the health of the AWS system to that given by the self-test routine. RSSB Page 39 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

4.1.1.3.2 When carrying out an AWS self-test in these circumstances, it is not necessary to test that a brake demand is requested if this has been done when the train or cab was powered up.

Rationale G 4.1.1.3.3 Testing or monitoring the AWS provides assurance that the system will be capable of providing the necessary train protection functionality when the train transitions from the alternative train protection system.

Guidance G 4.1.1.3.4 There are two methods of assuring that the AWS system will operate correctly when the train transitions from an alternative train protection system: a) Causing the system to perform a self-test at the point of transition. b) Monitoring the functionality of the system when it is in a suppressed state, and indicating to the driver a fault that means that it will not operate correctly when it is unsuppressed. G 4.1.1.3.5 It is sometimes required to carry out the AWS self-test at the point of transition from an alternative system to AWS without stopping the train. In these circumstances it would be impracticable to require a brake demand to be initiated as part of the self- test routine.

4.1.1.4 Successful completion of AWS self-test 4.1.1.4.1 On successful completion of the self-test routine the trainborne AWS equipment shall move to the operational ready state.

Rationale G 4.1.1.4.2 When the self-test has confirmed that the AWS sub-system is in a healthy state, the equipment is ready to detect and respond to magnets on the track.

Guidance G 4.1.1.4.3 No guidance.

4.1.1.5 Failure to successfully complete AWS self-test 4.1.1.5.1 If the AWS self-test fails to complete successfully, the trainborne AWS equipment shall provide notification to the driver.

Rationale G 4.1.1.5.2 If the self-test routine fails to complete, the driver is made aware that AWS is not operational so that the appropriate action can be taken to deal with faulty equipment.

Page 40 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Guidance G 4.1.1.5.3 When the self-test includes initiation of a brake demand, failure to complete the test usually results in the brakes remaining applied. It may then be necessary to isolate the system to release the brakes in order to allow the train to be moved. G 4.1.1.5.4 When the self-test does not include a brake demand, failure to complete the test does not usually result in a brake application, but may prevent the system switching to AWS mode. The driver is given a clear warning of the failure and may need to apply the appropriate operating rules if the train is to enter AWS-fitted lines with the system not fully operational.

4.2 Requirements for trainborne TPWS equipment

4.2.1 Circumstances when the TPWS trainborne subsystem is not required to be operational 4.2.1.1 The TPWS train sub-system is not required to be operational in the circumstances set out below: a) The TPWS train sub-system may be temporarily isolated: i) When vehicles fitted with TPWS are working in a T3 possession. ii) When temporary block working or emergency special working is implemented and a train is required to pass signals at danger, with authority, in accordance with GERT8000. iii) On driving units with an active cab that is not at the front of the train, in accordance with GERT8000. b) It is permissible to suppress the operation of the TPWS train sub-system when an alternative train protection system is fitted and operational on both the train and the track over which the train is to operate.

Rationale for a) G 4.2.1.2 Vehicles operating within a possession are protected by the applicable operating rules which do not depend on the observance of fixed signals; in some cases drivers might be required to disregard the aspects displayed by signals. G 4.2.1.3 Temporary block working and emergency special working are forms of degraded working introduced when parts of the signalling system have failed or are unavailable. Trains are authorised to disregard the aspects displayed by a number of signals and to pass them if they are at danger. In such circumstances it would be inappropriate for the train to be tripped by TPWS on passing these signals, and TPWS is therefore temporarily isolated. Alternative protection is provided by the special operating rules which are applied. G 4.2.1.4 When a train has to be driven from a cab which is not at the front of the train, TPWS can be isolated to avoid unwanted interventions. Otherwise the train would be tripped by TPWS at signals which would be replaced to danger when the first vehicle passes the signal, thus energising the TPWS TSS loops before the active TPWS receiver passes over them.

RSSB Page 41 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Rationale for b) G 4.2.1.5 When a train is operating with an alternative train protection system, the TPWS trainborne equipment can be suppressed. This prevents unwarranted TPWS interventions which could otherwise occur when the train is operating in accordance with its MA under the constraints provided by the alternative system.

Guidance on b) G 4.2.1.6 It is not necessary to suppress TPWS if either: a) No TPWS track equipment is provided on the section of track where the alternative system is used, or b) TPWS interventions will only occur when the train is operating outside the parameters of its MA, and any duplication of warnings or interventions that could arise between TPWS and the other system will not create conflicting or confusing indications to the driver.

4.2.2 Trainborne TPWS power-up self-test 4.2.2.1 The TPWS shall perform a power-up test, as set out in 5.7.1, when the system is started, subject to awaiting initialisation of ETCS when the TPWS indications are presented by the ETCS DMI.

Rationale G 4.2.2.2 As TPWS is a critical safety system, its correct operation is tested before a train enters service.

Guidance G 4.2.2.3 The power-up test is normally started as soon as the TPWS is powered up, but where the TPWS indications are integrated into the ETCS DMI it may be necessary to delay the start of the test until the DMI indications are available.

4.2.3 Trainborne TPWS equipment in-service monitoring

4.2.3.1 In-service monitoring of trainborne TPWS equipment 4.2.3.1.1 The TPWS shall undertake system monitoring while in service. System monitoring shall continue to be undertaken while the train is operating with TPWS suppressed, as set out in 4.2.1.

Rationale G 4.2.3.1.2 As TPWS is a critical safety system and, unlike AWS, cannot be monitored by the driver observing its regular operation during a journey, the system monitors its correct operation while in service.

Guidance G 4.2.3.1.3 No guidance.

Page 42 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

4.2.3.2 Indication of a trainborne TPWS fault 4.2.3.2.1 A TPWS fault that results in loss of the protection normally provided by TPWS shall be indicated as a fault, as set out in 5.8.2, but shall not apply the brakes solely due to the detection of the fault.

Rationale G 4.2.3.2.2 A train is taken out of service if TPWS is not operational because the protection it provides is no longer available. A fault which requires action to be taken is indicated to the driver. G 4.2.3.2.3 The brakes are not applied automatically when a fault is detected, as bringing the train immediately to a stand in an uncontrolled manner may introduce more risk than allowing the driver to stop the train in a controlled manner.

Guidance G 4.2.3.2.4 RIS-3437-TOM sets out requirements for contingency plans to be applied when on- train equipment, including TPWS, becomes defective.

4.2.3.3 In-service monitoring and fault display functions of onboard TPWS 4.2.3.3.1 The in-service monitoring and fault display functions shall not disable or compromise the train stop or overspeed functionality of the TPWS, or the functionality of the AWS. Detection of a fault shall not suppress an existing brake demand.

Rationale G 4.2.3.3.2 Even when a fault has been detected, TPWS might still be able to intervene when required, and AWS might still be operational. The ability of the system to provide protection should be maintained where possible.

Guidance G 4.2.3.3.3 No guidance.

4.2.3.4 Faults to be detected by in-service monitoring of onboard TPWS equipment 4.2.3.4.1 Faults to be detected while the train is in service shall include: a) Electrical continuity failure between the aerial and the control unit. b) Degradation in signal transfer between the aerial and the control unit. c) A control unit fault that could result in loss of TPWS protection.

Rationale G 4.2.3.4.2 Detectable faults that mean that the train is no longer being protected by TPWS are indicated to the driver, as these may require the train to be taken out of service.

Guidance G 4.2.3.4.3 No guidance.

RSSB Page 43 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

4.3 Output requirements

4.3.1 Outputs from AWS/TPWS to on-train data recording 4.3.1.1 In addition to the on-train data recording requirements set out in GMRT2472, AWS and TPWS shall supply suitable and sufficient outputs to facilitate connection to the on-train data recorder, to enable the status of each of the TPWS DMI functions to be recorded.

Rationale G 4.3.1.2 The specific cause of a brake demand (SPAD, Overspeed or AWS) is a safety-related function and is therefore required to be recorded individually. Additionally, acknowledgement, cancellation and isolation inputs are recorded in order to facilitate incident investigation.

Guidance G 4.3.1.3 A serial data link may be necessary to accommodate the required number of outputs to the data recorder – this may raise compatibility issues with existing data recorders used with earlier versions of TPWS equipment which had parallel data outputs. G 4.3.1.4 AWS and TPWS related activities to be recorded are likely to include the following, although the precise application is vehicle specific: a) Train brake demand by AWS or TPWS. b) Operation of AWS and the driver’s response. c) Isolation of AWS. d) Operation of TPWS and the driver’s response. e) Isolation and override of TPWS. f) Operation of the AWS visual indicator. g) Operation by the driver of the AWS reset pushbutton. h) Sounding of the audible AWS caution indication (horn or electronic tone). i) Sounding of the audible AWS clear indication (bell or electronic chime). j) Brake demand requested by AWS or TPWS. k) Isolation of the AWS/TPWS control unit. l) Operation by the driver of the TPWS acknowledge pushbutton(s). m) Normal direction TPWS transmitter loop detected. n) Opposite direction TPWS transmitter loop detected. o) Train stop override (TSO) pushbutton operated. p) Fault and / or temporary isolation of the TPWS control unit. q) Full isolation of the TPWS control unit.

4.3.2 Outputs from the AWS/TPWS to the vigilance system 4.3.2.1 An output shall be provided from the AWS acknowledgement device to reset the driver vigilance system when an AWS warning has been acknowledged.

Page 44 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale G 4.3.2.2 This enables an AWS acknowledgement to be recognised as a relevant driver activity that resets the vigilance system and reduces the need for the driver to make a separate action to reset the vigilance system.

Guidance G 4.3.2.3 No guidance.

RSSB Page 45 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Part 5 AWS/TPWS Driver Machine Interface (DMI)

5.1 Introduction to the AWS/TPWS DMI

Guidance G 5.1.1 The train driving task is a continuous process, which requires the train driver to: a) Monitor the railway environment. b) Obtain information from indications provided at the lineside and within the cab, from other people and use of procedures. c) Assimilate all the available information and use it to inform decisions. d) Control the train to maintain the required speed, including starting, stopping, accelerating, and braking. G 5.1.2 Part 5 sets out the requirements of AWS/TPWS onboard subsystems that support train driving, the rationale for the requirements, and guidance on how to meet the requirements. The requirements permit a physical panel-based DMI solution or a visual display unit (VDU) based DMI solution. A VDU based solution may be integrated with the ERTMS/ETCS DMI. G 5.1.3 Part 5 incorporates findings from RSSB research projects: a) T906, which conducted a task and error analysis to evaluate the benefits of integrating Class B CCS systems into ETCS, from the train driver perspective. b) T1079, which proposed a VDU DMI design based on train driver feedback. G 5.1.4 The requirements can be used to inform the design of the AWS/TPWS DMI so that it contributes to a rail vehicle design that is capable of being safely integrated with train operations on the GB mainline railway. This is supported if the AWS/TPWS DMI is: a) Operable. b) Readable. c) Audible. d) Interpretable. G 5.1.5 These capabilities are realised if: a) The controls enable train drivers to interact with the AWS/TPWS onboard subsystem correctly and efficiently. b) The indications enable train drivers to easily obtain and correctly interpret necessary information. G 5.1.6 A Proposer can use conformity with the DMI requirements to support a claim that hazards arising at the AWS/TPWS interface with train drivers, which contribute to SPAD risk and overspeed risk, are controlled. These hazards include: a) Poor operability. b) Poor readability. c) Poor audibility. d) Poor interpretability.

Page 46 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

G 5.1.7 It is good practice to consult with the train operating company that will operate the rail vehicles before finalising the design of the AWS/TPWS DMI. If the train operator is not known, the assumptions about the operational context should be recorded so that they can be used by the train operator to inform their decisions about safe integration. G 5.1.8 GERT8000 Rule Book and RS522 set out the operating rules and procedures relevant to the AWS/TPWS. G 5.1.9 Appendix A, AWS/TPWS DMI system models includes some structural and functional viewpoints of the AWS/TPWS DMI that illustrate the interfaces with other systems.

5.2 Integrating the AWS/TPWS DMI into a rail vehicle

5.2.1 Configuration of AWS/TPWS DMI controls and indications 5.2.1.1 The configuration of the AWS/TPWS DMI controls and indications shall be consistent for each type or class of rail vehicle throughout an RU's fleet.

Rationale G 5.2.1.2 Integration with train operations: Providing an AWS/TPWS DMI that has a consistent layout, appearance and functionality supports the train driving task and reduces the likelihood of human error. It also supports train driver learning and knowledge retention, which assists drivers who frequently change stock type and simplifies driver stock conversion training.

Guidance on managing inconsistency G 5.2.1.3 Inconsistency in layout, appearance or functionality within a rail vehicle fleet might arise due to: a) Existing rail vehicles fitted with an AWS/TPWS DMI compliant with a previous standard. b) Transfer of rail vehicles with a different design of AWS/TPWS DMI from another RU. c) Fitment of a compliant AWS/TPWS DMI during the migration phase. G 5.2.1.4 Any risk arising from inconsistency can be managed through train driver training and briefing.

Guidance on provision of AWS functionality G 5.2.1.5 Where a rail vehicle is fitted with TPWS but not AWS, the DMI incorporates only the controls and indications required for TPWS.

Guidance on a panel-based DMI solution G 5.2.1.6 Appendix B, AWS/TPWS control and indication panel details the industry agreed and endorsed panel-based DMI solution which was developed following industry research and consultation into the causes of TPWS 'reset and go' risk. This design takes account of the range of environments in which the panel may be located and operated. RSSB Page 47 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Guidance on a VDU based DMI solution G 5.2.1.7 Appendix C, AWS/TPWS DMI VDU layouts shows examples of screen layouts for implementation of the AWS/TPWS DMI on both touch screen and soft key types of VDU. G 5.2.1.8 Glare can affect the readability of all VDU based controls and indications, including the ETCS onboard subsystem DMI. G 5.2.1.9 Touch screen and soft key controls and indications can be activated to draw the train driver's attention at any given moment, which can eliminate the likelihood of human error of operating wrong controls. Risk assessment is used to confirm that implementing this functionality would not encourage train drivers to operate the AWS/TPWS DMI controls without following operating procedures.

Guidance on an ETCS integrated DMI solution G 5.2.1.10 ERTMS/ETCS DMI controls have three states: ‘enabled’, ‘disabled’ or ‘pressed’. G 5.2.1.11 If the AWS/TPWS is integrated with the ERTMS/ETCS DMI, the DMI will only display the controls and indicators that are applicable to the given ETCS level. G 5.2.1.12 In Levels NTC, NID_NTC=20 or 21, the presence of the AWS/TPWS controls and indicators on the VDU screen, in particular the AWS ‘sunflower’, reminds the train driver that the train protection is provided by the TPWS, not the ETCS. In other levels, the absence of AWS/TPWS controls and indicators will remind the driver that the train is protected by the ETCS. G 5.2.1.13 These cues support the train driving task when the train transitions between Class A and Class B systems and would not be available if the AWS/TPWS DMI is not integrated with the ERTMS/ETCS DMI. G 5.2.1.14 An integrated DMI will: a) Reduce the amount of equipment fitted to the driving cab desk. b) Reduce clutter within the cab and provide the train driver with one interface. This is likely to reduce task complexity. c) Allow all audible and visual alarms and indications to be controlled by one central ‘system’, which can avoid visual or auditory conflicts within the cab. G 5.2.1.15 RIS-0797-CCS and RIS-0798-CCS set out further requirements for integrating AWS/ TPWS with the ERTMS/ETCS onboard subsystem.

Guidance on 'dual-screen' VDU DMI solution G 5.2.1.16 Some rail vehicle designs implement a ‘dual-screen’ VDU based DMI solution, to meet a specified reliability and availability target. In this case, the relevant AWS/ TPWS DMI controls and indications are presented on one or both of the VDU screens during normal operations. If one of the VDU screens fails, the CCS onboard subsystem is configured to present the AWS/TPWS controls and indications on the remaining operational VDU screen. Integration of the AWS/TPWS controls and indications into a single VDU screen might be inconsistent with the minimum dimensions set out in this RIS. Assessment of the proposed design can be used to confirm:

Page 48 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

a) The visible indications are readable and interpretable in the degraded mode operational context. b) The VDU based controls are operable in the degraded mode operational context. G 5.2.1.17 The degraded mode assessment takes account of the requirements for degraded mode operations set out in the RU safety management system. Any assumptions, dependencies and caveats underpinning the assessment decision are recorded in the technical file. The assessment record can be used by the RU to confirm that the degraded AWS/TPWS controls and indications are fit for their intended purpose.

Guidance on further requirements G 5.2.1.18 GMRT2161 sets out the requirements for the layout of driving cabs for rail vehicles operated on the GB mainline railway, including the positioning of primary controls. G 5.2.1.19 GMRT2185 sets out further requirements for the security of the isolation controls for train safety systems. G 5.2.1.20 ERA-ERTMS-015560 version 3.6.0 sets out further requirements for the ERTMS/ETCS DMI screen layout, including the ‘sub-areas’ in terms of number of cells, number of cells in total grid array (640 x 480), and minimum size of the total display area. G 5.2.1.21 BS EN 16186-2:2017 sets out further requirements for integration of drivers’ cab displays, controls and indicators.

5.2.2 AWS/TPWS DMI controls and indications: colour specifications 5.2.2.1 AWS/TPWS DMI controls and indications provided on a panel shall meet the following colour specifications: • Yellow: Pantone Yellow C. • Red: Pantone 186C. 5.2.2.2 AWS/TPWS DMI controls and indications presented on a VDU shall comply with the colour specifications for ETCS indications set out in ERA-ERTMS-015560.

Rationale G 5.2.2.3 Readability: The specified colour parameters provide clear and distinctive colours which can readily be distinguished by the train driver, supporting readability of the AWS/TPWS controls and indications.

Guidance G 5.2.2.4 No guidance.

5.3 AWS/TPWS DMI controls

5.3.1 AWS/TPWS DMI controls to be provided 5.3.1.1 The AWS/TPWS DMI shall provide the following controls: a) AWS caution acknowledgement. b) AWS brake demand acknowledgement.

RSSB Page 49 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

c) SPAD brake demand acknowledgement. d) Overspeed brake demand acknowledgement. e) Brake release. f) Train stop override. g) TPWS temporary isolation. h) AWS isolation. i) AWS/TPWS isolation.

Rationale G 5.3.1.2 Integration with train operations: The train driver uses the DMI controls to interact with the AWS/TPWS to comply with the rules for train driving, which include the following: a) Acknowledgement of an AWS warning. b) Acknowledgement of a SPAD brake demand initiated by the TPWS. c) Acknowledgement of an overspeed brake demand initiated by the TPWS. d) Release of the train brake after a brake demand. e) Isolation of the AWS function, the TPWS function, or the AWS/TPWS functions.

Guidance on parameters G 5.3.1.3 The AWS/TPWS DMI includes controls which are grouped together and incorporated in a panel or VDU display and other controls which are provided as discrete devices on the driver's desk or elsewhere in the rail vehicle. G 5.3.1.4 Clauses 5.3.3 to 5.3.9 set out the parameter requirements for each control device, including: a) Type. b) Appearance parameters: size, colour, luminance, shape, and labelling. The appearance and labelling of the control devices helps the train driver to correctly distinguish each control when operating the AWS/TPWS onboard subsystem. c) Number of states or functions. Section 5.5 sets out the functional requirements for each AWS/TPWS control. d) Position: This parameter defines the position of the control device within the rail vehicle and describes the layout of the AWS/TPWS DMI, which is relevant to its ease of use. G 5.3.1.5 If a parameter is not relevant to a specific control device, this is shown as ‘not applicable’. G 5.3.1.6 If a parameter is relevant but it is not necessary to specify a prescriptive value to that parameter, the value is shown as ‘unspecified’ and guidance on good practice is included. G 5.3.1.7 The parameter 'size' for a button on a panel specifies the minimum size of the button, excluding any surrounding bezel. G 5.3.1.8 When a panel-based DMI is provided, it is good practice to provide buttons that depress by at least 2 mm when operated and with a consistent resistance within the range 2.8 to 15 newtons. Page 50 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

G 5.3.1.9 It is good practice for controls to provide audible and/or tactile feedback to the train driver. Panel and soft key DMI solutions can inherently provide tactile feedback.

Guidance on labelling G 5.3.1.10 Labelling of panels and other physical devices is designed to be readable, permanent and durable. G 5.3.1.11 Good practice for labelling on a DMI panel so that it is readable provides lettering: a) In capitals. b) In a sans serif font. c) With minimum character height of 5 mm. d) When viewed from the driving position, subtending as a minimum a visual angle of 15 minutes. e) With high contrast against the panel background. G 5.3.1.12 ERA_ERTMS_015560 version 3.6.0 sets out further requirements for labelling of ERTMS/ETCS DMI controls and indications.

5.3.2 AWS/TPWS DMI: cab layout 5.3.2.1 The controls described in 5.3.1.1 a) – f) shall be positioned so that the train driver can interact with the controls from the normal driving position, without being impeded by other cab equipment, controls, or structures.

Rationale G 5.3.2.2 Integration with train operations: The train driving task includes train driver interaction with the AWS/TPWS DMI at any time. Any driving cab features that obscure the controls and indications, or make interaction more difficult, would influence the likelihood of human error during train operations.

Guidance G 5.3.2.3 Potential train driver errors include: a) Accidental operation of an AWS/TPWS control whilst using other cab controls. b) Wrong operation of an AWS/TPWS control.

5.3.3 AWS caution acknowledgement control 5.3.3.1 The AWS caution acknowledgement control device parameters shall conform with the values set out in Table 4. Parameter Value

Type Physical push button (self-restoring)

Size Unspecified Colour Unspecified Luminance Not applicable

RSSB Page 51 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Parameter Value Shape Unspecified States Two: a) Not operated (self-restored state) b) Operated (when fully depressed)

Position A discrete, 'primary control', located on the driving desk in each driving cab Located so that it can be operated from the normal driving position and cannot be operated by someone seated in another cab position

Identity label Unspecified

Table 4: AWS caution acknowledgement control

Rationale G 5.3.3.2 Integration with train operations: A discrete physical push button that is consistently positioned as a primary control on the train driver's desk can be located and operated quickly. A control that cannot be located and operated quickly increases the likelihood of delay in acknowledging an AWS warning and could result in an unnecessary brake application. G 5.3.3.3 Safe integration: Positioning the control so that it is only operable by someone in the normal driving position is intended to control the likelihood of mis-use. If another person operates the acknowledgement control, this might mean that the train driver has not fully recognised the AWS warning, or observed the associated signal aspect or warning sign.

Guidance G 5.3.3.4 The train driver operates the AWS acknowledgment button in response to the AWS warning audible indication, which sounds on the approach to lineside signals displaying a cautionary aspect and lineside operational signs that are provided with an AWS permanent magnet. Therefore, this control needs to be robust and easy to operate. G 5.3.3.5 Providing the acknowledgement control as part of an integrated VDU-based DMI would not be suitable for the quick, easy and positive response required. G 5.3.3.6 The AWS caution acknowledgement control device is usually positioned on the right- hand side of the driving desk.

Page 52 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Figure 2: Example designs of AWS caution acknowledgement control

5.3.4 Brake demand acknowledgement control 5.3.4.1 The AWS brake demand acknowledgement control device parameters shall conform with the values set out in Table 5. Parameter Value

Type Panel: Push button (self-restoring) VDU based solution: Icon or soft key

Size Minimum diameter or width: 10 mm Colour Yellow

Luminance Panel: Combined with AWS brake demand and acknowledgement indication VDU based solution: Sufficiently bright in all expected lighting conditions to be identifiable and to be differentiated from other AWS/ TPWS controls and indications

RSSB Page 53 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Parameter Value

Shape Panel: Circular VDU based solution: Circular, rectangular or square

States Two: a) Not operated (self-restored or enabled position) b) Operated (when pressed)

Position A ‘primary control’, located on the driving desk in each driving cab Positioned close to and aligned with the SPAD and overspeed brake demand indicators / acknowledgement controls Positioned either below or to the right of the SPAD and overspeed brake demand acknowledgement controls Touch screen VDU solution: When integrated into the ERTMS/ETCS DMI; within DMI sub- areas ‘C’ or ‘G’ Soft key VDU solution: When integrated into the ERTMS/ETCS DMI; a soft key positioned next to the identity labels in DMI sub-areas ‘F’ or ‘H’

Identity label Panel: 'AWS' VDU based solutions: ‘AWS’ legend positioned within the icon

Table 5: AWS brake demand acknowledgement control 5.3.4.2 The SPAD brake demand acknowledgement control shall conform with the parameters set out in Table 6. Parameter Value

Type Panel: Push button (self-restoring) VDU based solution: Icon or soft key

Size Minimum diameter or width: 10 mm Colour Red

Page 54 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Parameter Value

Luminance Panel: Combined with SPAD brake demand and acknowledgement indication VDU based solution: Sufficiently bright in all expected lighting conditions to be identifiable and to be differentiated from other AWS/ TPWS controls and indications.

Shape Panel: Circular VDU based solution: Circular, rectangular or square

Number of states Two: a) Not operated (self-restored or enabled position) b) Operated (when fully depressed)

Position A ‘primary control’, located on the driving desk in each driving cab Positioned close to and aligned with the AWS and overspeed brake demand indicators / acknowledgement controls Positioned either above or to the left of the AWS and overspeed brake demand acknowledgement controls Touch screen VDU solution: When integrated into the ERTMS/ETCS DMI; within DMI sub- areas ‘C’ or ‘G’ Soft key VDU solution: When integrated into the ERTMS/ETCS DMI; a soft key positioned next to the identity labels in DMI sub-areas ‘F’ or ‘H’

Identity label Panel: 'SPAD' VDU based solutions: ‘SPAD’ legend positioned within the icon

Table 6: SPAD brake demand acknowledgement control 5.3.4.3 The overspeed brake demand control shall conform with the parameters set out in Table 7.

RSSB Page 55 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Parameter Value

Type Panel: Push button (self-restoring) VDU based solution: Icon or soft key

Size Minimum diameter or width: 10 mm Colour Yellow

Luminance Panel: Combined with overspeed brake demand and acknowledgement indication VDU based solution: Sufficiently bright in all expected lighting conditions to be identifiable and to be differentiated from other AWS/ TPWS controls and indications

Shape Panel: Circular VDU based solution: Circular, rectangular or square

Number of states Two: a) Not operated (self-restored or enabled position) b) Operated (when pressed)

Position A ‘primary control’, located on the driving desk in each driving cab Positioned close to and aligned with the AWS and SPAD overspeed brake demand acknowledgement controls Positioned either below or to the right of the SPAD brake demand acknowledgement control Touch screen VDU solution: When integrated into the ERTMS/ETCS DMI; within DMI sub- areas ‘C’ or ‘G’ Soft key VDU solution: When integrated into the ERTMS/ETCS DMI; a soft key positioned next to the identity labels in DMI sub-areas ‘F’ or ‘H’

Identity label Panel: ‘OVERSPEED’ VDU based solutions: ‘TPWS OSS’ legend positioned within the icon

Table 7: Overspeed brake demand control Page 56 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale G 5.3.4.4 Integration with train operations: Configuring the AWS/TPWS DMI so that the three brake demand acknowledgement controls have similar characteristics, and are consistently positioned together, supports the train driver in observing the correct procedures following an AWS/TPWS brake intervention. G 5.3.4.5 Interpretability: The red colour makes the SPAD brake demand acknowledgement control visually distinctive from the other brake demand acknowledgement controls, which are coloured yellow. The colour red supports concept compatibility with a stop aspect; the colour yellow supports concept compatibility with signal aspects and indications that provide cautionary information.

Guidance G 5.3.4.6 The SPAD or overspeed brake demand acknowledgement control is operated in conjunction with the brake release control following a TPWS brake demand. This is intended to confirm that the train driver has recognised the cause of the brake application and has followed the appropriate operating procedures. G 5.3.4.7 If the diameter of the brake demand acknowledgement control is less than 20 mm, it is good practice for the push button to protrude above the panel surface or surrounding bezel by a distance greater than the operational stroke. G 5.3.4.8 10 mm is compatible with the dimension specified in ERA-ERTMS-015560 for ERTMS/ ETCS DMI sub-area ‘C’ or 'G'.

5.3.5 Brake release control 5.3.5.1 The brake release control shall conform with the parameters set out in Table 8. Parameter Value

Type Panel: Push button (self-restoring), incorporating a self-closing, hinged cover VDU based solution: outlined ‘target’ or soft key; disabled until the preconditions for brake release are satisfied

Size Minimum diameter or width: 10 mm

Colour Panel: Black Touch screen or soft key VDU: a) Disabled: grey target area with black text b) Enabled: white target area with black text

RSSB Page 57 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Parameter Value

Luminance Panel: not applicable VDU based solution: Sufficiently bright in all expected lighting conditions to be identifiable and to be differentiated from other AWS/ TPWS controls and indications.

Shape Panel: Circular VDU based solution: Circular, rectangular or square

Number of states Two: a) Not operated (self-restored or enabled position) b) Operated (when pressed)

Position A ‘primary control’, located on the driving desk in each driving cab Positioned close to brake demand indicators/ acknowledgement controls Touch screen VDU solution: When integrated into the ERTMS/ETCS DMI; within DMI sub- areas ‘C’ or ‘G’ Soft key VDU solution: When integrated into the ERTMS/ETCS DMI; a soft key positioned next to the identity label within DMI sub-areas ‘F’ or ‘H’

Identity label Panel based solution: ‘BRAKE RELEASE’ VDU based solutions: ‘Brake Rel’ legend positioned within the icon

Table 8: Brake release control

Rationale G 5.3.5.2 Safe integration: The design of the brake release control is intended to: a) Protect against accidental operation of the brake release. b) Require a conscious decision to depress the brake release button. G 5.3.5.3 Integration with train operations: Configuring the AWS/TPWS DMI so that the brake release control is positioned close to the brake demand acknowledgement controls supports the train driver in observing the correct procedures following an AWS/TPWS brake intervention.

Page 58 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

G 5.3.5.4 Interpretability: The black colour makes the brake release control visually distinctive from the other AWS/TPWS DMI controls.

Guidance G 5.3.5.5 The train driver operates the brake release control and the control associated with the relevant brake demand indication; this is intended to confirm that the driver has recognised the cause of the brake application, informed the signaller, and carried out appropriate procedures. G 5.3.5.6 10 mm is compatible with the dimension specified in ERA-ERTMS-015560 for ETCS DMI sub area ‘C’ or 'G'. G 5.3.5.7 Some AWS/TPWS DMI panel implementations have incorporated a brake release button that is 18 mm (minimum) diameter, which is larger than the minimum size defined in ERA-ERTMS-015560. Using ETCS DMI sub-area ‘G’ would replicate the larger size of this control on the panel-based solution.

5.3.6 Train stop override control 5.3.6.1 The train stop override control shall conform with the parameters set out in Table 9. Parameter Value

Type Panel: Push button (self-restoring), which does not protrude above the panel surface or any surrounding bezel VDU based solution: Icon or soft key incorporating a 2 s delay

Size Minimum width: 10 mm

Colour Panel: Yellow VDU based solution: see Table 17 for associated indication

Luminance Panel: Combined with the train stop override indication VDU based solution: Sufficiently bright in all expected lighting conditions to be identifiable and to be differentiated from other AWS/ TPWS controls and indications

Shape Panel: Square VDU based solution: Rectangular or square

RSSB Page 59 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Parameter Value Number of states Two: a) Not operated (self-restored or enabled position) b) Operated (when pressed).

Position A ‘primary control’, located on the driving desk in each driving cab Combined with the train stop override visual indication Touch screen VDU solution: When integrated into the ERTMS/ETCS DMI; within DMI sub- areas ‘C’ or ‘G’ Soft key VDU solution: When integrated into the ERTMS/ETCS DMI; a soft key positioned next to the identity label within DMI sub-areas ‘F’ or ‘H’

Identity label Panel: ‘TRAIN STOP OVERRIDE’ VDU based solutions: ‘TSO’ legend positioned within the icon

Table 9: Train stop override control

Rationale G 5.3.6.2 Integration with train operations: The design of the button control and the 2 s delay on a VDU control avoids the likelihood that a train driver will inadvertently operate the train stop override control. G 5.3.6.3 Interpretability: The identity label makes the train stop override control visually distinctive from the other AWS/TPWS DMI controls.

Guidance G 5.3.6.4 This control overrides the TPWS train stop function for a limited time to allow the train to pass a signal at danger without initiating a TPWS brake application. G 5.3.6.5 10 mm is compatible with the dimension specified in ERA-ERTMS-015560 for ETCS DMI sub area ‘C’ or 'G'. G 5.3.6.6 Legacy AWS/TPWS DMI panel implementations have incorporated a train stop override button that is 17 mm (minimum) wide, which is larger than the minimum size defined in ERA-ERTMS-015560. Using ETCS DMI sub-area ‘G’ would replicate the larger size of this control on the panel-based solution. G 5.3.6.7 Good practice for a VDU based DMI is to display a text message prompt to remind the train driver of the 2 s delay, for example 'Press and hold the TSO for 2 s to

Page 60 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

activate the train stop override', that appears when the train stop override control is pressed.

5.3.7 TPWS temporary isolation control 5.3.7.1 The TPWS temporary isolation control shall conform with the parameters set out in Table 10. Parameter Value Type A centre-biased ON/OFF switch Size Not specified Colour Not specified Luminance Not applicable Shape Not specified Number of states Two: a) Normal b) Isolated

Position On the rail vehicle in a position that is accessible to the train driver If provided within driving cab, sited out of reach of the train driver when in the normal driving position

Identity label ‘TPWS TEMPORARY ISOLATION’ with two operating positions labelled ‘NORMAL’ and ‘ISOLATE'

Table 10: TPWS temporary isolation control

Rationale G 5.3.7.2 Safe integration: The position of the TPWS temporary isolation control is intended to reduce the likelihood that it will be operated during normal train operations. Isolating the TPWS function might increase SPAD risk and overspeed risk to an unacceptable level. Operating a train with an isolated TPWS onboard subsystem without authority would be a contravention of the Railway Safety Regulations 1999.

Guidance G 5.3.7.3 Temporary isolation of TPWS allows the train to pass several signals at danger without needing to use the train stop override at each signal. It can be used in situations such as temporary block working or emergency special working. G 5.3.7.4 The rules for operating the TPWS temporary isolation control are set out in the GERT8000 Rule Book.

RSSB Page 61 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

G 5.3.7.5 Further requirements for the security of the isolation controls for train safety systems are set out in GMRT2185.

5.3.8 AWS isolation control 5.3.8.1 The AWS isolation control shall conform with the parameters set out in Table 11. Parameter Value Type Physical switch Size Not specified Colour Not specified Luminance Not applicable Shape Not specified Number of states Two: a) Normal b) Isolated

Position On the rail vehicle in a position that is accessible to the train driver If provided within driving cab, sited out of reach of the train driver when in the normal driving position

Identity label 'AWS' with two positions labelled 'NORMAL' and 'ISOLATE'

Table 11: AWS isolation control

Rationale G 5.3.8.2 Safe integration: The position of the AWS isolation control is intended to reduce the likelihood that it will be operated during normal train operations. Removing the AWS functionality might increase SPAD risk and overspeed risk. G 5.3.8.3 Integration with train operations: In some failure scenarios it might be necessary to isolate the AWS on the rail vehicle to move the train. When AWS needs to be isolated because of a fault which affects only the AWS onboard subsystem, independent isolation of AWS makes it possible to keep TPWS operational and retain the protection given by TPWS.

Guidance G 5.3.8.4 A rail vehicle fitted with AWS has one AWS isolation control; this includes rail vehicles that have two driving cabs. A multiple unit is fitted with two AWS isolation controls, one for each AWS fitted rail vehicle.

Page 62 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

G 5.3.8.5 The rules for isolating and de-isolating the AWS are set out in the GERT8000 Rule Book. G 5.3.8.6 Further requirements for the security of the isolation controls for train safety systems are set out in GMRT2185.

5.3.9 AWS/TPWS isolation control 5.3.9.1 The AWS/TPWS isolation control shall conform with the parameters set out in Table 12. Parameter Value Type Physical switch Size Not specified Colour Not specified Shape Not specified Number of states Two: a) Normal b) Isolated

Position On the rail vehicle in a position that is accessible to the train driver If provided within driving cab, sited out of the reach of the train driver when in the normal driving position

Visibility Not specified Identity label 'AWS/TPWS' with two positions labelled 'NORMAL' and 'ISOLATE'

Table 12: AWS/TPWS isolation control

Rationale G 5.3.9.2 Safe integration: The position of the AWS/TPWS isolation control is intended to reduce the likelihood that it will be operated during normal train operations. Removing the AWS and TPWS functionality might increase SPAD risk and overspeed risk. Operating a train with an isolated TPWS onboard subsystem without authority would be a contravention of the Railway Safety Regulations 1999. G 5.3.9.3 Integration with train operations: In some failure scenarios it might be necessary to isolate the AWS and TPWS on the rail vehicle to move the train.

Guidance G 5.3.9.4 This control provides a means of completely isolating the AWS and TPWS functionality on the rail vehicle so that it can be moved.

RSSB Page 63 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

G 5.3.9.5 The isolation control may be duplicated on rail vehicles that have more than one driving cab. G 5.3.9.6 The rules for isolating and de-isolating the AWS/TPWS are set out in the GERT8000 Rule Book. G 5.3.9.7 Further requirements for the security of the isolation controls for train safety systems are set out in GMRT2185.

5.4 AWS/TPWS DMI indications

5.4.1 AWS/TPWS DMI indications to be provided 5.4.1.1 The AWS/TPWS DMI shall provide the indications set out in Table 13. Type Indication Meaning (information conveyed) format Audible Horn AWS warning Visual Black and AWS warning acknowledged yellow (sunflower) Audible Bell AWS clear Visual Flashing AWS brake demand NOT acknowledged yellow light Steady yellow AWS brake demand acknowledged light Visual + Flashing red SPAD brake demand NOT acknowledged audible light Tone + voice message Visual Steady red SPAD brake demand acknowledged light Visual + Flashing Overspeed brake demand NOT acknowledged audible yellow light Tone + voice message Visual Steady yellow Overspeed brake demand acknowledged light Visual Steady yellow TPWS train stop override control operated light Visual Steady yellow TPWS onboard subsystem is temporarily light isolated

Page 64 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Type Indication Meaning (information conveyed) format Visual Flashing AWS/TPWS fault detected yellow light Visual Open point - AWS onboard subsystem is isolated see 5.4.8

Table 13: AWS/TPWS DMI indications

Rationale G 5.4.1.2 Integration with train operations: The train driver uses the DMI indications to obtain information necessary to comply with the train driving rules.

Guidance G 5.4.1.3 The AWS/TPWS DMI includes indications which are grouped together and incorporated in a panel or VDU display and other indications which are provided as discrete devices on the train driver's desk or elsewhere in the rail vehicle. G 5.4.1.4 The requirements in 5.4.2 to 5.4.8 set out further requirements for each AWS/TPWS indication. The requirements specify the audible parameters and visual appearance parameters that help the train driver to correctly distinguish and interpret the indications being given. G 5.4.1.5 If a parameter is not relevant to a specific indication, this is shown as ‘not applicable’. G 5.4.1.6 If a parameter is relevant but it is not necessary to specify a prescriptive value to that parameter, the value is shown as ‘unspecified’ and guidance on good practice is included. G 5.4.1.7 The parameter 'size' for an indication on a panel specifies the minimum size of the lens or illuminated area, excluding any surrounding bezel.

5.4.2 Audibility of AWS/TPWS indications 5.4.2.1 The volume of the AWS and TPWS audible indications shall be within the range 65 dBA to 95 dBA and be at least 6 dB above ambient, measured at all driving positions in the cab. 5.4.2.2 The AWS/TPWS DMI audible indications shall conform with the parameters set out in Table 14.

RSSB Page 65 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Identity Parameter Value(s) AWS warning Frequency 800 Hz (+/- 20 Hz) Tone/ Single, steady tuned tone harmonics Speech Not applicable content Duration Continuous until the AWS warning acknowledgement control is operated AWS clear Frequency 1200 Hz (+/- 30 Hz) Tone/ Simulated chime or ringing bell harmonics Speech Not applicable content Duration 0.5 to 1.5 s

SPAD brake Frequency Priming tone followed by speech message: demand ‘SPAD alert, contact the signaller’ Tone/ harmonics Sound file on RSSB website at https:// www.rssb.co.uk/Library/standards-and-the-rail- Speech industry/sound-files/priming-tone-plus- content spad.wav

Duration Continuous until the SPAD brake demand acknowledgement control is operated Volume After 60 s: Volume reduced by 6 dB

Overspeed Frequency Priming tone followed by speech message: brake demand ‘Overspeed, contact the signaller’ Tone/ harmonics Sound file on RSSB website at https:// www.rssb.co.uk/Library/standards-and-the-rail- Speech industry/sound-files/priming-tone-plus- content overspeed.wav

Duration Continuous until the overspeed brake demand acknowledgement control is operated, or until a SPAD brake demand occurs Volume After 60 s: Volume reduced by 6 dB

Table 14: AWS and TPWS audible indications

Page 66 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale G 5.4.2.3 Audibility: The volume supports and influences audibility of the presented indications in the operational context. G 5.4.2.4 Interpretability: The speech messages are provided to reinforce the train driver's understanding that the brake demand on the train has been initiated by the TPWS and to distinguish between a SPAD alert and an overspeed alert. G 5.4.2.5 Interpretability: The format of the SPAD and overspeed brake demand audible indications means that the priming tone precedes the relevant speech announcement. The tone and speech announcement do not sound simultaneously because this would adversely affect interpretability. G 5.4.2.6 Train driver learning: Providing consistent and distinctive AWS/TPWS audible indications, which are differentiated from other audible indications in the cab supports train driver learning and knowledge retention. G 5.4.2.7 Integration with train operations: When the train has come to a stand, the train driver is required to contact the signaller. If for some reason the train driver has not acknowledged the alert, or is unable to, the speech message continues but reduces in volume after one minute to reduce the likelihood that it will interfere with communication between the train driver and the signaller.

Guidance G 5.4.2.8 The AWS audible indication is the primary indication that AWS gives to the train driver, which the driver interprets as part of the train driving task. G 5.4.2.9 The TPWS audible indications are presented together with a visual indication and a brake application. G 5.4.2.10 The two AWS audible indications approximate to the audible indications generated using the technology available when the AWS was first implemented on rail vehicles: a) The AWS warning indication was generated by passing the air escaping from the brake pipe through a tuned horn. b) The AWS clear indication was generated by an electro-mechanical bell.

This technology is still used in some heritage rail vehicles; however, on most rail vehicles the AWS audible indications are generated using electronic components.

G 5.4.2.11 RSSB research report T902 provides further information about the SPAD and overspeed audible indications. The key components of these alarms are: a) A priming tone, which is a 3-pulse tone with a fundamental frequency of 440 Hz, with regular harmonics at 880, 1320, 1760 and 2220 Hz. Each of the pulses is 300 ms in length with no time intervals between them, resulting in a length of 900 ms for the complete priming tone. In order to avoid a startle response, each pulse is subject to an Attack-Sustain-Decay-Release (ASDR) amplitude envelope. b) A female voice was chosen for the speech messages because the female voice is more suitable where there is considerable low frequency noise, which is the case for train cabs. A non-urgent, relatively monotonic style with no stress on any words, evenly paced syllables and clear enunciation is used. RSSB Page 67 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

G 5.4.2.12 The TSI LOC & PAS sets out further requirements for the audibility of cab indications. G 5.4.2.13 The TSI Noise sets out further requirements for measuring ambient sound levels. G 5.4.2.14 RIS-0797-CCS and RIS-0798-CCS set out further requirements for the volume of ETCS onboard subsystem audible indications.

5.4.3 Luminance of AWS/TPWS DMI lit indications 5.4.3.1 The luminance of the AWS/TPWS lit indications shall be sufficient so that they are readable over the full range of ambient cab lighting levels.

Rationale G 5.4.3.2 Readability: Luminance supports and influences the readability of lit indications in the operational context.

Guidance G 5.4.3.3 Train drivers will read and interpret the AWS/TPWS indications throughout the range of cab lighting conditions applicable to the rail vehicle when it is being driven as a train. Excessive luminance of lit indications is a problem if a lit indication distracts the train driver from the train driving task or obscures another cab indication that needs to be read. Excessive luminance is more likely to be a problem when trains are driven in dark environments. G 5.4.3.4 A means of adjusting the indication luminance may be provided to accommodate the range of ambient light levels experienced in the operational context. The range of adjustment provides a means for the train driver to set the luminance at a level so that the lit indications can be easily read without reducing the luminance to the point where the information being presented cannot be reliably interpreted. G 5.4.3.5 RIS-0797-CCS and RIS-0798-CCS set out further requirements for luminance of ETCS cab indications.

5.4.4 Visual indication parameters: AWS warning acknowledged 5.4.4.1 The ‘AWS warning acknowledged’ indication ('sunflower') shall conform with the parameters set out in Table 15. Parameter Values Overall appearance A circular symmetrical image, incorporating multiple yellow sectors of equal size and spacing, contrasted against a black background

Colour Sectors: yellow Background: black

Page 68 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Parameter Values

Shape Indication: circular Yellow sectors: minimum 8, maximum 10, all the same shape Yellow sector angle: 11° to 18°

Size Indication outer diameter: minimum 42 mm All yellow sectors of equal size Yellow sector width: equal to, or narrower than, the sector spacing Yellow sector outer dimension: 5 mm (+/- 1 mm) less than the indication outer diameter Yellow sector inner diameter: 15 to 20 mm

Display element spacing All sectors equally spaced Sector spacing: equal to, or greater than, the sector width

Number of states Two: a) Displayed (‘black and yellow’) b) Not displayed (‘all black’)

Flashing rate Steady, non-flashing appearance

Position Sited within the cab so that the displayed indication is clearly visible from the driving position to which it applies, when looking at the track ahead When integrated into the ERTMS/ETCS DMI VDU screen: Within DMI sub-area ‘D’

Identity label Not applicable

Table 15: AWS warning acknowledged indication ('sunflower') 5.4.4.2 Where duplicate indicators are provided in the same driving cab, the ‘AWS warning acknowledged’ indications shall be synchronised in their operation.

Rationale G 5.4.4.3 Readability: The minimum specified dimensions support readability of the indication. G 5.4.4.4 Interpretability: Providing an ‘AWS warning acknowledged’ indication that has a consistent and distinctive appearance supports interpretability in the context of the train driving task, supports train driver learning and knowledge retention.

RSSB Page 69 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Guidance G 5.4.4.5 If a cab is provided with two driving desks, a separate indicator may be needed on each desk to support readability of the AWS warning acknowledged indication from each driving position. G 5.4.4.6 Section 5.6.3 sets out the functional requirements for the AWS warning acknowledged visual indication. G 5.4.4.7 The ‘all black’ display is continuously shown: a) When the last AWS indication was a clear indication. b) When an AWS warning audible indication has been given, before the AWS caution acknowledgement control has been operated. G 5.4.4.8 The appearance of this indication is derived from the original design of the electro- mechanical AWS indicator, which incorporated a fixed plate perforated with segmental slots and a rotating disc with black and yellow sectors, which showed through the slots. This technology is still used in some heritage rail vehicles; however, on most rail vehicles the indication is generated using electronic components. G 5.4.4.9 An indication larger than 42 mm diameter might be necessary to achieve a display that is readable. Some rail vehicles are still fitted with an electro-mechanical indicator that presents an indication that is up to 90 mm in diameter, incorporating 10 yellow sectors. G 5.4.4.10 Size, luminance, the number of yellow sectors and sector spacing combine to influence the readability of this indication and its prominence relative to other cab features. G 5.4.4.11 An indication comprising eight yellow sectors and a 42 mm diameter has been successfully implemented on rail vehicles that incorporate either: a) A panel based DMI solution using LED technology. b) A VDU based DMI solution, which presents the indication directly in front of the train driver. G 5.4.4.12 When presented in the form of an image within an integrated ETCS DMI display, it is good practice to highlight the area with a grey border so that the 'all black' circle is visible. G 5.4.4.13 The distinctive appearance of the ‘sunflower’ display means that there is no need to provide an identity label. G 5.4.4.14 Figure 3 shows an example of an ‘AWS warning acknowledged’ indication incorporating eight yellow sectors.

Page 70 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Figure 3: Example of the AWS warning acknowledged indication ('sunflower')

5.4.5 Visual indication parameters: Brake demand and acknowledgement indications 5.4.5.1 The AWS, SPAD and overspeed brake demand and acknowledgement indications shall conform with the parameters set out in Table 16. Parameter Values Overall appearance Coloured lit indication

Colour AWS: yellow SPAD: red Overspeed: yellow

RSSB Page 71 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Parameter Values Shape and spacing Panel and touch screen VDU: a) AWS indications integrated with AWS brake demand acknowledgement control b) SPAD indications integrated with SPAD brake demand acknowledgement control c) Overspeed indications integrated with overspeed brake demand acknowledgement control Soft key VDU based solution: circular, rectangular or square, positioned next to the relevant soft key control

Size Minimum diameter or width: 10 mm Number of states Three: a) Unlit b) Lit, steady c) Lit, flashing

Flashing rate Lit, steady: Steady, non-flashing appearance Lit, flashing: 2 Hz ± 0.25 Hz with a 50% ± 5% duty cycle

Position Within the AWS/TPWS panel or VDU screen area. Panel and touch screen VDU based solution: a) AWS indication integrated with the AWS brake demand acknowledgement control b) SPAD indications integrated with the SPAD brake demand acknowledgement control c) Overspeed indications integrated with the overspeed brake demand acknowledgement control Soft key VDU based solution: The indication shall be presented in DMI sub-area 'F' or 'H', next to the relevant soft key control device

Identity label Labelling for associated brake demand acknowledgement control as set out in Table 5 (AWS), Table 6 (SPAD) and Table 7 (overspeed)

Table 16: Brake demand and acknowledgement indications

Page 72 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale G 5.4.5.2 Interpretability: The red indication makes the SPAD brake demand visually distinctive from the other brake demand indications, which are coloured yellow. The colour red supports concept compatibility with a stop aspect; the colour yellow supports concept compatibility with signal aspects and indications that provide cautionary information. The initial flashing state is intended to attract the train driver's attention to the AWS/ TPWS brake demand and to serve as a reminder that action is necessary. The steady indication continues to remind the train driver of the cause of the brake application and confirms that the brake demand has been acknowledged. G 5.4.5.3 Train driver learning: The consistent layout and appearance of the brake demand and acknowledgement indicators, and their integration into the associated control devices, support train driver learning and knowledge retention. G 5.4.5.4 Interpretability: Incorporating the indication into or next to the control device helps the train driver to correctly identify the applicable control.

Guidance G 5.4.5.5 This standard specifies three separate brake demand indications, which enable the train driver to confirm the cause of the brake application. To release the brakes following a brake demand, the relevant brake demand acknowledgement control is operated in conjunction with the brake release control. G 5.4.5.6 Initial TPWS onboard subsystem designs provided one brake demand indication, which did not enable the train driver to distinguish between SPAD or overspeed causes. The same indication also indicated a brake application due to a failure to acknowledge an AWS warning. G 5.4.5.7 10 mm is compatible with the dimension specified in ERA-ERTMS-015560 for ETCS DMI sub area ‘C’.

5.4.6 Visual indication parameters: Train stop override indication 5.4.6.1 The train stop override indication shall conform with the parameters set out in Table 17. Parameter Values Overall appearance Coloured lit indication

Colour Panel: Yellow VDU based solution: when 'lit', yellow with black lettering; when 'unlit', black with white lettering

Shape Panel: Square VDU: Rectangular or square

Spacing Not applicable

RSSB Page 73 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Parameter Values Size Minimum width: 10 mm Number of states Two: a) Unlit b) Lit, steady

Flashing rate Not applicable

Position Within the AWS/TPWS panel or VDU screen area Panel and touch screen VDU based solution: integrated with the ‘train stop override’ control Soft key VDU based solution: The indication shall be presented in DMI sub-area 'F' or 'H', next to the relevant soft key control device

Identity label Labelling for train stop override control as set out in Table 9

Table 17: Train stop override indication

Rationale G 5.4.6.2 Interpretability: The rectangular shape makes the train stop override indication on a panel visually distinctive from the other AWS/TPWS DMI indications, which are circular.

Guidance G 5.4.6.3 The train driver uses the lit train stop override indication to confirm that the train stop override is effective, so that the train will be able to pass a signal at danger without being tripped by TPWS. G 5.4.6.4 When the train stop override time has expired, the lit indication is extinguished. G 5.4.6.5 10 mm is compatible with the dimension specified in ERA-ERTMS-015560 for ETCS DMI sub-area ‘C’. G 5.4.6.6 Legacy AWS/TPWS DMI panel implementations have incorporated a train stop override indicator that is larger than the minimum size defined in ERA- ERTMS-015560. Using ETCS DMI sub-area ‘G’ would replicate the larger size of this indicator on the panel-based solution.

5.4.7 Visual indication parameters: TPWS temporary isolation/fault indication 5.4.7.1 The TPWS temporary isolation/fault indications shall conform with the parameters set out in Table 18.

Page 74 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Parameter Values Overall appearance Coloured lit indication Colour Yellow

Shape Panel: Circular VDU-based solution: Circular, rectangular or square

Spacing Not applicable Size Minimum diameter or width: 10 mm Number of states Three: a) Unlit b) Lit steady (TPWS temporary isolation) c) Lit flashing (fault)

Flashing rate Lit steady: Steady, non-flashing appearance Lit flashing: 2 Hz ± 0.25 Hz with a 50% ± 5% duty cycle

Position Within the AWS/TPWS panel or VDU screen area A ‘primary indication’ positioned close to and aligned with the ‘train stop override’ and ‘brake release’ controls Panel: Positioned either above or to the left of the ‘train stop override’ control Integrated into the ETCS DMI touch screen: Within DMI sub-area ‘C’ or ‘G’

Identity label Panel: ‘TEMPORARY ISOLATION / FAULT VDU based solution: a) ‘ISOL’ when lit steady b) ‘FAULT’ when lit flashing

Table 18: TPWS temporary isolation/fault indication

Rationale G 5.4.7.2 Interpretability: The distinctive appearance makes the TPWS temporary isolation/ fault indications visually distinctive from the other AWS/TPWS DMI indications. The temporary isolation indication is provided to remind the driver that TPWS has been isolated, and that it should be restored to use when the train reaches the end of the section for which the temporary isolation was authorised. The flashing indication RSSB Page 75 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

makes the TPWS ‘fault’ conspicuous and differentiates it from the temporary isolation indication. G 5.4.7.3 Integration with train operations: The three states are provided to help the train driver decide whether the TPWS onboard subsystem is operating correctly, is failed, or is temporarily isolated.

Guidance G 5.4.7.4 When the indication is unlit, the TPWS is operating correctly and is not isolated. G 5.4.7.5 When the TPWS system detects a fault, or when the AWS/TPWS onboard subsystem start-up test is not successfully completed, the indication flashes to inform the train driver that the onboard subsystem is in a failed state. G 5.4.7.6 The steady indication informs the train driver that the TPWS onboard subsystem has been temporarily isolated. G 5.4.7.7 10 mm is compatible with the dimension specified in ERA-ERTMS-015560 for ETCS DMI sub-area ‘C’. G 5.4.7.8 Legacy AWS/TPWS DMI panel implementations have incorporated an indicator that is larger than the minimum size defined in ERA-ERTMS-015560. Using ETCS DMI sub- area ‘G’ would replicate the larger size of this indicator on the panel-based solution.

5.4.8 Visual indication parameters: AWS isolation/fault indication 5.4.8.1 [Open Point]

Rationale G 5.4.8.2 Integration with train operations: Train drivers need to understand whether the AWS onboard subsystem is operating correctly, is failed or is isolated.

Guidance G 5.4.8.3 GMRT2185 sets out further requirements for indicating AWS isolation. G 5.4.8.4 This open point can be closed by either: a) Integrating the AWS isolation/fault indication with the ‘TPWS temporary isolation/fault indication’. b) Providing a separate indicator with the same visual characteristics as the ‘TPWS temporary isolation/fault indication’. In this case, the AWS and TPWS isolation/ fault indication labels include the qualifiers ‘AWS’ and ‘TPWS’. G 5.4.8.5 The option chosen should consider any rules that require train drivers to distinguish between a failure that affects the TPWS or the AWS or the AWS/TPWS.

5.5 AWS/TPWS DMI control functions

5.5.1 AWS caution acknowledgement control function 5.5.1.1 Operating the AWS caution acknowledgement button shall:

Page 76 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

a) Acknowledge the AWS audible warning. b) Prevent the application of the train brakes if the control is operated within the caution acknowledgement delay period. 5.5.1.2 It shall not be possible to acknowledge an AWS warning by: a) Permanently operating the AWS caution acknowledgement button. b) Operating the AWS caution acknowledgement button before the ‘restrictive response state’ is entered. c) Operating the AWS brake demand acknowledgement control.

Rationale G 5.5.1.3 Safe integration: The AWS is designed to prevent an AWS acknowledgement being stored, which would increase the likelihood of a SPAD or an overspeed event. G 5.5.1.4 Integration with train operations: The train driver operates the AWS caution acknowledgement button to confirm awareness of the cautionary signal aspect or warning sign to which it applies. G 5.5.1.5 Train driver learning: Designing the system so that an AWS warning is acknowledged only by operating the AWS caution acknowledgement button supports train driver learning and knowledge retention, so that the method of acknowledgement is consistent for all implementations.

Guidance G 5.5.1.6 The response of the AWS warning acknowledged indication to the operation of the AWS caution acknowledgement control is applicable irrespective of whether a brake demand has been initiated. Section 5.6.3 sets out further requirements for the indication response. G 5.5.1.7 If the train driver does not acknowledge the AWS warning within the specified caution acknowledgement delay period, the train brakes are automatically applied. G 5.5.1.8 GERT8075 sets out requirements for the caution acknowledgement delay period and the AWS ‘restrictive response state’.

5.5.2 Independence of AWS caution acknowledgement control function from TPWS functionality 5.5.2.1 Operating the AWS caution acknowledgement button shall not acknowledge a SPAD brake demand or an overspeed brake demand.

Rationale G 5.5.2.2 Safe integration: Maintaining functional independence between the AWS caution acknowledgement and the TPWS brake demand acknowledgement functions supports the train driver in recognising the cause of a brake demand so that the correct procedures are followed.

RSSB Page 77 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Guidance G 5.5.2.3 No guidance.

5.5.3 TPWS train stop override control function 5.5.3.1 Operating the train stop override control shall activate the train stop override function until one of the following criteria is met: a) The TPWS onboard subsystem detects an active TSS loop. b) A pre-set time, not exceeding 60 s, has elapsed since the train stop override control was operated. 5.5.3.2 Continuously depressing the train stop override button shall not extend the time that the override function is active.

Rationale G 5.5.3.3 Safe integration: The TPWS override function provides a means for the train driver to pass a TPWS fitted signal at danger without the train brake being activated by the TPWS. The TPWS is designed to prevent incorrect operation, which would increase the likelihood of an operating incident. Disabling the override function as soon as a TSS is detected, or after a pre-set time, prevents a train driver from selecting and storing an override for future use. The override function is therefore effective only if it is operated immediately before passing the signal at danger, so that the use of this facility is clearly associated with the signal concerned.

Guidance G 5.5.3.4 The pre-set time needs to be long enough for a train to pass a signal and associated TSS loop after the TPWS train stop override button has been pressed. G 5.5.3.5 A pre-set time of 20 s is used for passenger trains. G 5.5.3.6 A pre-set time of 60 s is used for locomotives that operate freight trains. G 5.5.3.7 Where a locomotive is used for passenger and freight train operations, the pre-set time can take account of the needs of freight train operations.

5.5.4 TPWS start-up control functions 5.5.4.1 When a cab is made operational: a) The AWS/TPWS power-up test shall be initiated. b) Any TPWS override and temporary isolation functions previously applied shall be automatically removed. c) Any detected TPWS onboard subsystem faults shall be indicated.

Rationale G 5.5.4.2 Safe integration: When a cab is made operational, the train driver needs to know that the TPWS onboard subsystem is operating correctly so that it can provide the necessary train protection functionality.

Page 78 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Guidance G 5.5.4.3 Section 5.7 sets out further requirements for the AWS/TPWS power-up test.

5.5.5 Brake release control function 5.5.5.1 Following a brake application initiated by the AWS/TPWS, the train brakes shall release only when the following conditions are satisfied: a) The brake demand has been acknowledged. b) 59 s have elapsed after the AWS/TPWS has initiated the brake application. c) After the 59 s has elapsed, either: i) On a panel based solution, the relevant brake demand acknowledgement control and the brake release control are operated together, or ii) On a VDU based solution, the relevant brake demand acknowledgement control is operated and then, within 5 s, the brake release control device is operated. 5.5.5.2 The brake release conditions set out in 5.5.5.1 shall be maintained if power to the AWS/TPWS onboard subsystem is removed and restored.

Rationale G 5.5.5.3 Safe integration: The AWS/TPWS DMI is designed to control the likelihood of an unwanted event due to a train driver incorrectly releasing the train brakes following a brake demand. The brake release function is designed to assist train drivers in applying the correct procedures following an AWS/TPWS brake demand. It is not used for any other purpose. G 5.5.5.4 Safe integration: Requiring the train driver to select and operate the relevant brake acknowledgement control at the same time as the brake release control is intended to reinforce the reason for the train brake being applied. G 5.5.5.5 Safe integration: Delaying the effectiveness of the brake release function for 59 s provides enough time for: a) The train brake to be effective in decelerating the train. b) The train driver to interpret the presented brake demand indication and understand that the train brake application is due to an AWS/TPWS initiated brake demand. G 5.5.5.6 Safe integration: The AWS/TPWS is designed so that the train driver cannot shortcut the brake release functionality by shutting down and restoring the subsystem.

Guidance G 5.5.5.7 The AWS/TPWS brake demand results in an emergency (or where available enhanced emergency) brake application. In many cases, 59 s is enough time for the train to stop. If the train has not fully stopped after 59 s, it will have significantly reduced speed.

RSSB Page 79 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

G 5.5.5.8 The relevant brake demand acknowledgement control device is the device associated with the activated brake demand indication at the time that the train brake is applied. These are: a) AWS brake demand acknowledgement control. b) SPAD brake demand acknowledgement control. c) Overspeed brake demand acknowledgement control. G 5.5.5.9 The VDU based solution incorporates a 5 s time limit because the technology may not permit simultaneous operation of two controls, recognising that the intention is to operate the two controls together.

5.5.6 Brake release control function in the event of multiple AWS/TPWS brake demands 5.5.6.1 When the AWS brake demand indication and the overspeed brake demand indication are lit at the same time, operating the overspeed brake demand acknowledgement control with the brake release control shall: a) Release the train brakes. b) Extinguish both brake demand indications. 5.5.6.2 When the AWS brake demand indication and the overspeed brake demand indication are lit at the same time, operating the AWS brake demand acknowledgement control with the brake release control shall: a) Extinguish the AWS brake demand indication. b) Not release the train brakes. c) Not extinguish the overspeed brake demand indication.

Rationale G 5.5.6.3 Safe integration: The DMI is designed to draw attention to the TPWS overspeed intervention, to assist the train driver in applying the correct procedures when releasing the train brake. G 5.5.6.4 Interpretability: The AWS provides additional audible and visual indications which are intended to elicit another, separate train driver response. The AWS visual indication is maintained after the brakes have been released to remind the train driver that an AWS warning has been received and acknowledged.

Guidance G 5.5.6.5 No guidance.

5.6 AWS/TPWS indication functions

5.6.1 AWS clear indication 5.6.1.1 The AWS clear audible indication shall start to sound when the AWS/TPWS onboard subsystem enters the AWS clear signal response state.

Page 80 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale G 5.6.1.2 Interpretability: The AWS clear indication (bell) is consistent with an unrestricted proceed signal aspect.

Guidance G 5.6.1.3 The train driver does not acknowledge the AWS clear audible indication. G 5.6.1.4 GERT8075 sets out further information about the AWS clear signal response state.

5.6.2 AWS warning indication 5.6.2.1 The AWS warning audible indication shall start to sound when the AWS/TPWS onboard subsystem enters the AWS restrictive response state.

Rationale G 5.6.2.2 Interpretability: The AWS warning indication (horn) assists the train driver to correctly observe the cautionary signal aspect or warning sign to which it applies.

Guidance G 5.6.2.3 The AWS warning audible indication (horn) is the only form of warning given by the AWS. It continues to sound until it is acknowledged. The AWS visual indication is only displayed when the audible indication has been acknowledged. G 5.6.2.4 GERT8075 sets out further information about the AWS restrictive response state.

5.6.3 AWS acknowledgement indication functions 5.6.3.1 When the AWS caution acknowledgement control is operated: a) The AWS warning audible indication (horn) shall be silenced within 100 ms. b) The AWS warning acknowledged visual indication (sunflower) shall be displayed within 100 ms.

Rationale G 5.6.3.2 Interpretability: The train driver uses the change to the AWS indications to confirm that the AWS warning has been acknowledged. G 5.6.3.3 Train driver learning: A consistent AWS indication response supports train driver learning and knowledge retention.

Guidance G 5.6.3.4 If delayed acknowledgement of the AWS warning results in a brake demand, operating the AWS caution acknowledgement button acknowledges the AWS audible warning and the AWS brake demand indication.

RSSB Page 81 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

5.6.4 AWS brake demand indication functions 5.6.4.1 The AWS brake demand indication shall flash when an AWS brake demand is initiated. 5.6.4.2 The AWS brake demand indication shall change from lit flashing to lit steady when the AWS caution acknowledgement control is operated.

Rationale G 5.6.4.3 Interpretability: The train driver uses the lit flashing indication to confirm that the brake demand is caused by an AWS intervention, and uses the lit steady indication to confirm that the brake demand has been acknowledged.

Guidance G 5.6.4.4 The brake demand is activated following an AWS warning that has not been acknowledged within the AWS caution acknowledgement delay period. G 5.6.4.5 After acknowledgement, the AWS brake demand indication remains lit to remind the train driver of the cause of the brake demand.

5.6.5 SPAD brake demand indication functions 5.6.5.1 The SPAD brake demand indication shall flash when the TPWS aerial at the front of the train passes over an active TSS loop and a brake demand is initiated. 5.6.5.2 The SPAD brake demand indication shall change from lit flashing to lit steady when the SPAD brake demand acknowledgement control is pressed and released.

Rationale G 5.6.5.3 Train driver learning: Consistent functionality supports train driver learning and knowledge retention. G 5.6.5.4 Interpretability: The train driver uses the lit flashing indication to confirm that the brake demand results from a SPAD intervention and uses the lit steady indication to confirm that the brake demand has been acknowledged.

Guidance G 5.6.5.5 A SPAD brake demand is acknowledged when the SPAD brake demand acknowledgement control is pressed and released. G 5.6.5.6 After acknowledgement, the SPAD brake demand indication remains lit to remind the train driver of the cause of the brake demand.

5.6.6 Overspeed brake demand indication functions 5.6.6.1 The overspeed brake demand indication shall flash when the TPWS aerial at the front of the train passes over an active OSS loop and a brake demand is initiated. 5.6.6.2 The overspeed brake demand indication shall change from lit flashing to lit steady when the overspeed brake demand acknowledgement control is operated.

Page 82 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale G 5.6.6.3 Train driver learning: Consistent functionality supports train driver learning and knowledge retention. G 5.6.6.4 Interpretability: The train driver uses the lit flashing indication to confirm that the brake demand results from an overspeed intervention and uses the lit steady indication to confirm that the brake demand has been acknowledged.

Guidance G 5.6.6.5 An overspeed brake demand is acknowledged by pressing and releasing the overspeed brake demand acknowledgement control. G 5.6.6.6 After acknowledgement, the overspeed brake demand indication remains lit to remind the train driver of the cause of the brake demand.

5.6.7 AWS/TPWS brake demand indication combinations and transitions 5.6.7.1 When the AWS/TPWS is providing the train protection function, the three AWS/TPWS DMI brake demand indications shall conform with the combinations and transitions shown in Figure 4.

RSSB Page 83 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Figure 4: AWS/TPWS brake demand indication combination and transitions

Page 84 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Rationale G 5.6.7.2 Interpretability: Displaying consistent sequences of indications supports correct interpretation, and train driver learning and knowledge retention.

Guidance G 5.6.7.3 The indication sequences and transitions shown in Figure 4 are consistent with the train driving rules and procedures applicable to AWS/TPWS operations. G 5.6.7.4 Figure 4 excludes the sequences of indications shown: a) During the power-up test. Section 5.7 sets out the requirements for the sequence of indications during the power-up test b) When the AWS/TPWS is suppressed, in temporary override, or isolation c) When there is a fault. Section 5.8 sets out the requirements for fault indications.

5.6.8 AWS/TPWS DMI indication functions when the AWS/TPWS onboard subsystem is suppressed 5.6.8.1 When the AWS/TPWS onboard subsystem is suppressed: a) AWS/TPWS fault indication functions shall remain active. b) All other AWS/TPWS lit indications shall be disabled or extinguished.

Rationale G 5.6.8.2 Interpretability: When the train protection functionality is provided by another system (for example ERTMS/ETCS), disabling or extinguishing irrelevant AWS/TPWS indications declutters the driving desk and reduces the likelihood of distraction. G 5.6.8.3 Integration with train operations: The AWS/TPWS fault indication functionality is maintained to enable the train driver to monitor the system state and take appropriate action before the train reaches a location where TPWS is required to be in use.

Guidance G 5.6.8.4 Where an integrated DMI is provided, the facility to display Class B information on the ERTMS/ETCS DMI might not be available when the train is operating in ETCS other than in Level NTC. In this case, an alternative method of indicating a fault may be needed, for example, using the train management system.

5.6.9 SPAD brake demand indication functions: priority 5.6.9.1 When the TPWS onboard subsystem initiates a SPAD brake demand after it has initiated an OSS brake demand, the overspeed speech announcement shall be immediately terminated and replaced by the SPAD speech announcement.

RSSB Page 85 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Rationale G 5.6.9.2 Safe integration: The SPAD speech announcement is presented without delay because the consequence of a SPAD is potentially more serious than an overspeed event.

Guidance G 5.6.9.3 No guidance.

5.6.10 TPWS brake demand indications: speech announcement functions 5.6.10.1 Only one TPWS brake demand speech announcement shall be played at a time. 5.6.10.2 Once activated, the SPAD brake demand speech announcement shall: a) Play at least one complete cycle. b) Repeat the speech announcement, without the priming tone, with an interval of 3 s between the end of one announcement and the beginning of the next announcement until the SPAD brake demand acknowledgement control is operated. 5.6.10.3 Once activated, the overspeed brake demand speech announcement shall: a) Play at least one complete cycle, unless the SPAD brake demand function is activated. b) Unless terminated by the SPAD brake demand function, repeat the speech announcement, without the priming tone, with an interval of 3 s between the end of one announcement and the beginning of the next announcement until the overspeed brake demand acknowledgement control is operated.

Rationale G 5.6.10.4 Interpretability: Continued and clear presentation of the speech announcement reinforces the train driver's understanding of the cause of the brake demand. The complete announcement is played to control the likelihood of a train driver misinterpreting the indication.

Guidance G 5.6.10.5 Table 14 sets out the requirements for the content of the TPWS brake demand audible indications.

5.6.11 Independence of AWS audible indications and TPWS audible indications 5.6.11.1 TPWS audible indications shall not delay or prevent the operation of the AWS audible indications.

Rationale G 5.6.11.2 Interpretability: AWS audible indications are related to the signal or sign that the train is approaching, and they are sounded without delay so that the signal or sign is within the train driver's view when the indication sounds.

Page 86 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Guidance G 5.6.11.3 The AWS and TPWS provide separate, complementary contributions to train protection functionality. AWS indications are provided to draw the train driver’s attention to signal aspects and warning signs to reduce the likelihood of an unwanted event. The TPWS indications are provided to inform the train driver’s response to a brake demand to reduce the consequences of an unwanted event. G 5.6.11.4 The AWS and TPWS audible indications are distinctly different so that a train driver can detect whether one or the other are sounding, or both are sounding at the same time. G 5.6.11.5 Table 14 sets out the requirements for the AWS and TPWS audible indications.

5.6.12 TPWS temporary isolation indication functions 5.6.12.1 The temporary isolation indication shall be lit when the TPWS temporary isolation function is enabled.

Rationale G 5.6.12.2 Interpretability: The lit steady indication is used by the train driver to understand that the TPWS onboard subsystem has been temporarily isolated and that the rules for operating the train without TPWS protection are applicable.

Guidance G 5.6.12.3 Further requirements for the TPWS temporary isolation indication are set out in Table 18.

5.6.13 AWS/TPWS fault indication functions 5.6.13.1 The relevant fault indication shall be lit flashing when either of the following conditions are met: a) An AWS onboard subsystem fault is detected. b) A TPWS onboard subsystem fault is detected.

Rationale G 5.6.13.2 Interpretability: The lit flashing indication is used by the train driver to understand that the AWS or TPWS function has a fault and that the rules for operating the train with defective AWS or TPWS equipment are applicable.

Guidance G 5.6.13.3 This requirement is applicable to AWS/TPWS onboard subsystem faults that arise during the power-up test and faults that arise when the train is operating. G 5.6.13.4 The AWS/TPWS fault indications can be presented by the indicator that also presents the TPWS temporary isolation indication.

RSSB Page 87 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

G 5.6.13.5 Any TPWS temporary isolation function is automatically cancelled at power-up; therefore, the indicator will be extinguished at the end of the power-up test unless an AWS/TPWS onboard subsystem fault has been detected. G 5.6.13.6 Section 4.2.3.4 sets out further requirements for detection of TPWS onboard subsystem faults.

5.6.14 TPWS train stop override indication functions 5.6.14.1 The train stop override indication shall be presented (lit) when the TPWS train stop override function is active. 5.6.14.2 The train stop override indication shall be unlit following a power-up test and remain unlit until the train stop override function is activated.

Rationale G 5.6.14.3 Interpretability: The train stop override indication is used by the train driver to understand that the TPWS train stop override function is effective and the rules for passing a signal at danger are being applied.

Guidance G 5.6.14.4 When the train stop override times out, the indication is extinguished. G 5.6.14.5 Further requirements for the train stop override function are set out in 5.5.3.

5.7 AWS/TPWS onboard subsystem power-up test functions

5.7.1 Power-up test sequence 5.7.1.1 The AWS/TPWS onboard subsystem power-up test shall incorporate the following sequence of indications and control operations: a) All the indicators that display the indications set out in Table 13 shall be simultaneously lit and then simultaneously extinguished within 0.5 s of the power- up test commencing. b) The AWS warning audible indication (horn) shall sound. c) When the AWS caution acknowledgement control button is pressed and released: the AWS warning audible indication (horn) shall stop, the AWS clear indication (bell) shall sound for 0.5 (+ 0.5/-0) s, and the AWS warning acknowledgement visual indication (sunflower) shall be presented. 5.7.1.2 If, during the power-up test sequence, the AWS warning is not acknowledged, the AWS audible warning shall continue to sound for 30 s and the AWS/TPWS fault indication shall then be presented.

Rationale G 5.7.1.3 Safe integration: The power-up test allows the train driver to confirm that the AWS/ TPWS indications and the AWS warning acknowledgement button are operating correctly, before the train is operated.

Page 88 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

G 5.7.1.4 Reliability and availability: The AWS horn is silenced after 30 s if no acknowledgement has been received, as there might be a fault condition which prevents an acknowledgement being given. This allows the power-up test to continue without unnecessary disturbance to the train driver. G 5.7.1.5 Interpretability: The power-up test provides the train driver with the following opportunities to identify a fault: a) A lit fault indication. b) A failure of the AWS caution acknowledgement control. G 5.7.1.6 Integration with train operations: A consistent power-up test sequence supports train driver learning and knowledge retention. Extinguishing all the brake demand indicators means that when there is a lit brake demand indication, it is caused by a TPWS brake intervention.

Guidance G 5.7.1.7 No guidance.

5.7.2 Power-up test: Brake demand function 5.7.2.1 The AWS/TPWS power-up test shall initiate a brake demand. 5.7.2.2 If the power-up test identifies an AWS/TPWS onboard subsystem fault, the brake demand shall be sustained until both of the following conditions are met: a) Any AWS/TPWS onboard subsystem faults have been cleared b) An AWS/TPWS power-up test has been successfully completed.

Rationale G 5.7.2.3 Reliability and availability: The brake demand function is tested to confirm that the AWS/TPWS onboard system will be capable of initiating a train brake application when this is necessary. G 5.7.2.4 Safe integration: If the brake demand function is defective, the train brake is sustained to prevent the train from being operated without effective train protection functionality.

Guidance G 5.7.2.5 If the power-up test fails because the AWS caution acknowledgement button is not operated correctly, the power-up test can be restarted. G 5.7.2.6 If the power-up test fails and the train brake demand is sustained, the AWS/TPWS onboard system may need to be isolated to move the train.

5.7.3 Indication of successful completion of AWS/TPWS power-up test 5.7.3.1 Successful completion of the power-up test shall be indicated by the speech message: ‘TPWS and AWS operational’. 5.7.3.2 The speech message shall not be preceded by a priming tone.

RSSB Page 89 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Rationale G 5.7.3.3 Reliability and availability: Using a speech message to confirm successful completion of the power-up test allows the train driver to confirm that the speech message function is working correctly before the train is operated. G 5.7.3.4 Safe integration: The speech message capability is an essential component of the SPAD and overspeed audible indications that support the train driver in applying the correct procedures in response to a TPWS brake demand. G 5.7.3.5 Interpretability: The priming tone is omitted because there is no need to draw the train driver's attention to the power-up test taking place.

Guidance G 5.7.3.6 The speech message ‘TPWS and AWS operational’ can be found in the sound file on the RSSB website at https://www.rssb.co.uk/Library/standards-and-the-rail-industry/ sound-files/tpws-aws.wav. G 5.7.3.7 When the power-up test is successfully completed, all the brake demand indications are extinguished.

5.7.4 Reactivation of previous brake demand following AWS/TPWS power-up test 5.7.4.1 If the cab is powered down when a brake demand indication is displayed; when the cab is powered up again, and the power up test is complete: a) The train brakes shall remain applied. b) The same brake demand visual indicator(s) previously lit shall present a lit steady indication. c) The audible brake demand indications shall not sound.

Rationale G 5.7.4.2 Safe integration: This prevents a brake demand from being overridden by powering the cab down and powering it up again. G 5.7.4.3 Interpretability: The visual indication is provided to remind the train driver that the AWS/TPWS caused the brake demand, and that the rules for acknowledging and releasing the brakes apply.

Guidance G 5.7.4.4 If no brake demand is applicable, all the brake demand/acknowledgement indications are extinguished after the power-up test.

5.8 AWS/TPWS fault indications

5.8.1 Indication of faults detected during the AWS/TPWS power-up test 5.8.1.1 The AWS/TPWS DMI shall display the following when the AWS/TPWS power-up test detects a fault: a) The fault indication shall be lit flashing. Page 90 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

b) All other indications shall be extinguished.

Rationale G 5.8.1.2 Integration with train operations: When the system has failed to power-up correctly, all other AWS/TPWS indications are irrelevant. If there is a fault, displaying other indications might mislead the train driver into taking an incorrect action.

Guidance G 5.8.1.3 No guidance.

5.8.2 Indication of loss of AWS/TPWS protection 5.8.2.1 The AWS/TPWS DMI shall display the fault indication when there is a loss of the protection provided by the TPWS. 5.8.2.2 The fault indication shall continue to be displayed until any of the following applies: a) The fault has been rectified so that the TPWS protection is restored. b) The AWS/TPWS activates a brake demand. c) The TPWS temporary isolation function is activated.

Rationale G 5.8.2.3 Interpretability: The flashing fault indication is used to draw the train driver's attention to the TPWS fault and inform an understanding that the operational rules for operating the train without TPWS protection are applicable.

Guidance G 5.8.2.4 No guidance.

5.8.3 Suppression of AWS/TPWS fault indications 5.8.3.1 The AWS/TPWS fault indication shall be temporarily suppressed when either of the following conditions apply: a) An AWS/TPWS brake demand indication is displayed. b) The TPWS temporary override function is active, and the same indicator is used to display the TPWS fault indication and the TPWS temporary isolation indication. 5.8.3.2 The AWS/TPWS fault indication shall be unsuppressed when the brake demand is released or the temporary isolation is removed.

Rationale G 5.8.3.3 Interpretability: The fault indication is suppressed while the brake demand is active to control the likelihood of the flashing fault indication distracting the train driver from the brake demand indication. G 5.8.3.4 Integration with train operations: Indicating a temporary isolation is more important than indicating a fault, as the isolation removes all protection provided by TPWS, while in the case of a fault some protection may still be provided. RSSB Page 91 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Guidance G 5.8.3.5 If the train, despite the indicated fault, is still able to correctly initiate a SPAD or overspeed brake demand, this is indicated to the driver in the normal way by a flashing brake demand indication. G 5.8.3.6 Where a combined indicator is used for temporary isolation and faults, temporary isolation of the system overrides the (flashing) fault indication, as it uses the same indicator illuminated steadily. G 5.8.3.7 The fault indication is extinguished when the fault is no longer present.

Page 92 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Part 6 System Availability and Integrity

6.1 Availability and integrity of the AWS/TPWS system

6.1.1 AWS and TPWS equipment shall be designed, operated and maintained to have a level of availability that is as high as reasonably practicable, and shall, as a minimum, meet the following: a) The trainborne subsystem shall have an availability, measured on a ‘per fleet, per year’ basis, of not less than 99.9%. b) The AWS track subsystem shall have an availability, measured on an ‘AWS population, per year’ basis, of not less than 99.9%. c) The TPWS track subsystem shall have an availability, measured on a ‘TPWS population, per year’ basis, of not less than 99.9%.

Rationale G 6.1.2 To meet the shared responsibility for safe operation, both elements of the system – the trainborne subsystem and the track subsystem – for both AWS and TPWS are designed to the meet specified availability levels in order to provide an appropriate level of confidence in the availability of the overall system.

Guidance G 6.1.3 No guidance.

RSSB Page 93 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Appendices Appendix A AWS/TPWS DMI System Models

Figure 5: AWS/TPWS DMI structural viewpoint

Page 94 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Figure 6: Train driver operational context viewpoint: AWS DMI use cases

RSSB Page 95 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Figure 7: Train driver operational context viewpoint: TPWS DMI use cases

Page 96 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Appendix B AWS/TPWS Control and Indication Panel

B.1 Guidance on AWS/TPWS DMI panel configuration

Figure 8: AWS/TPWS panel layout

Figure 9: AWS/TPWS panel dimensions

B.1.1 Figures 8 and 9 set out the configuration of the AWS/TPWS control and indication panel that forms part of the DMI applied to rail vehicles that operate on the GB mainline railway. B.1.2 This configuration, including the layout and labelling, is compliant with the parameters set out in this standard and is available when applying the CSM RA risk acceptance principle: Comparison with a similar reference system and assessment. B.1.3 Modification to this configuration would involve a risk assessment to confirm that the change is acceptable.

RSSB Page 97 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Appendix C AWS/TPWS DMI VDU layouts

C.1 AWS/TPWS DMI Example Layouts for VDU Solutions

Figure 10: Example layout for touch screen VDU

Figure 11: Example layout for soft key VDU

C.1.1 The screen layouts above are taken from RSSB research report T1079, 'Coexistent operation of ERTMS and Class B (AWS and TPWS) systems: the development and user testing of an integrated DMI'.

Page 98 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

C.1.2 They are included as examples of the general layout of a VDU implementation of the AWS/TPWS DMI. C.1.3 The example layout for a soft key VDU shows how duplicating an indication enables the AWS/TPWS indications to be grouped in a consistent way and also identifies the applicable soft key.

RSSB Page 99 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Appendix D Not used

Page 100 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Appendix E Guidance on AWS Design Principles

E.1 Guidance on AWS design principles

Failure modes E.1.1 AWS equipment (both track and train sub-systems) should be designed and interfaced with other equipment and systems (including power supplies) so that, so far as is reasonably practicable, there is no credible failure mode, as experienced by the driver, which results in any of the following events: a) A ‘clear’ audible indication being given to the driver when a ‘warning’ indication should have been given. b) No indication being given when a ‘warning’ indication should have been given. c) A caution acknowledgement being effected – that is, the equipment entering the restrictive acknowledgement state or the brake demand acknowledgement state (as set out in GERT8075) – that was not initiated by the driver operating the caution acknowledgement device. d) Failure to initiate an AWS brake demand when such a brake demand is required. e) Release of an AWS brake demand when not initiated by the driver. E.1.2 Where it is not reasonably practicable to achieve this for any of the events set out above, then the event should, so far as is reasonably practicable, be made self- protecting or self-revealing. E.1.3 An AWS brake demand should be initiated automatically if the power supply to the trainborne AWS equipment fails. Such an event should not, however, prevent the trainborne equipment subsequently being isolated by the driver so that the train can be moved.

Compatibility E.1.4 Requirements for electromagnetic compatibility of railway equipment are set out in BS EN 50121. E.1.5 AWS track equipment should not jeopardise the safe operation of neighbouring equipment as a result of the electromagnetic fields that it generates. E.1.6 AWS track and trainborne equipment should be designed to withstand electromagnetic fields emitted by other equipment that might otherwise jeopardise the correct operation of the equipment. E.1.7 AWS track and trainborne equipment should be sufficiently robust to withstand, and continue to operate correctly under, all reasonably foreseeable levels of mechanical shock that might be experienced during normal railway operations. E.1.8 The interfaces between the AWS track equipment and the signalling system should be designed so as not to jeopardise the correct operation of either the AWS track equipment or the signalling system. E.1.9 The interfaces between the trainborne AWS equipment and other equipment and systems on board the train should be designed so as not to jeopardise the correct operation of either the trainborne AWS equipment or other equipment and systems.

RSSB Page 101 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Appendix F Guidance on AWS Receiver Sensitivity Testing

F.1 Guidance on AWS receiver sensitivity testing F.1.1 Trains entering service are required to have fully functional AWS equipment, in accordance with GERT8075, in any cab that is intended to be used. In particular, AWS receivers are required to meet the relevant sensitivity parameters set out in GERT8075. F.1.2 Operation of AWS is monitored by the driver, who is required to report an AWS failure in accordance with the Rule Book, module TW5. If an incorrect indication is received, or no indication is received where one is expected, the driver should report it. However, many AWS magnets have an actual flux density higher than the minimum specified level, and therefore correct operation of AWS may not confirm that the receiver is sufficiently sensitive to detect magnets at the lower end of the specified flux range. F.1.3 The AWS trainborne sub-system self-test routine, set out in 4.1.1, only tests the functionality and driver interface of the AWS train sub-system. It does not test the AWS receiver sensitivity. F.1.4 Railway undertakings should establish procedures within their safety management systems to confirm that AWS receivers meet the sensitivity values set out in GERT8075. F.1.5 The aim of the procedure is to provide assurance that trains will not operate with a non-compliant AWS receiver. F.1.6 Where vehicles are fitted with both standard strength and extra strength AWS receivers, the procedures should cover each type of AWS receiver. F.1.7 Historically, a depot test magnet was the established method of testing AWS receiver sensitivity, but it is permissible to use alternative methods to provide the required assurance. F.1.8 Where provided, the test magnet should be positioned so that trains that need to be tested pass over it before entering the main line network infrastructure. F.1.9 A depot test magnet simulates an AWS track magnet using a south pole in order to initiate an AWS warning indication in the cab. F.1.10 Depot test magnets are required to produce lower flux density levels than other AWS magnets in order to test the sensitivity of the AWS receiver and provide assurance that the receiver is sufficiently sensitive to detect magnets at the lower end of the specified flux range. F.1.11 GERT8075 sets out the required flux density levels for depot test magnets for standard strength and extra strength receivers respectively. F.1.12 An extra strength AWS receiver (which is less sensitive than a standard receiver) may not detect a standard strength depot test magnet, so an extra strength depot test magnet is required to confirm its operation. However, detection of an extra strength depot test magnet does not adequately test the required sensitivity of a standard strength AWS receiver.

Page 102 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

F.1.13 Depot test magnets only test the AWS receiver that is active when the train passes over the magnet. The AWS testing procedures should take account of circumstances where there is potential for operation of trains in service using a different receiver that has not been tested using the depot test magnet. F.1.14 Examples of such circumstances include cases when: a) A train reverses direction and a different receiver becomes active; b) A multiple unit train divides and another receiver becomes active; c) A switchable receiver is operated to an alternative sensitivity setting. F.1.15 The process of AWS receiver testing should take account of: a) The effectiveness of using depot test magnets and / or alternative methods to detect AWS receivers that do not comply with sensitivity requirements b) The effectiveness of procedures in detecting AWS receivers that have been damaged or displaced, and c) The level of assurance of AWS receiver stability.

RSSB Page 103 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Appendix H Description of AWS and TPWS Trainborne Equipment

H.1 Description of AWS and TPWS trainborne equipment

Introduction H.1.1 This section sets out an outline description of the components of the AWS and TPWS trainborne sub-system. As the functionality of AWS and TPWS is most often provided in a combined control unit, both AWS and TPWS equipment are described together to enable an understanding of the most commonly installed configurations. However, either system (AWS or TPWS) can be applied on its own and, in some cases, for example certain shunting locomotives, only TPWS has been implemented. H.1.2 AWS and TPWS components are supplied by a number of different manufacturers, and there are no mandatory technical specifications for the interfaces between individual components creating a manufacturers’ trainborne sub-system. Therefore, there are no guarantees that a component supplied by one manufacturer is compatible, under all foreseeable conditions, with a similar component from another manufacturer, unless this is declared by the manufacturers.

Trainborne sub-system components H.1.3 Figure 12 shows a typical trainborne sub-system, including both AWS and TPWS using a combined AWS and TPWS electronic control unit.

Page 104 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Figure 12: Typical AWS/TPWS trainborne sub-system H.1.4 The boxes shown dotted in Figure 12 are only necessary for a dual-cab single control unit configuration, such as on a locomotive.

Combined electronic control unit H.1.5 The combined AWS and TPWS control unit performs the logical functions, receiving various inputs and driving the external control and indication equipment. Most control units now in use are electronic, replacing the earlier relay logic types. H.1.6 The control unit may also provide specific outputs to reset the vigilance system (where a multi-resettable vigilance device is used) and outputs to train data recorders to enable recording of the detection of track magnets, together with the response of the trainborne sub-systems.

RSSB Page 105 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

AWS receiver H.1.7 The AWS receiver detects the presence of the south and north poles from the track- mounted magnets and provides a signal to the control unit that one or both of the magnets have been detected. Several different types of receiver exist (although not all types may still be in use), including pivoted permanent magnet, standard and high strength bi-stable reed relay type, twin lightweight bi-stable reed relay, and electronic / solid state. H.1.8 Some traction units may be fitted with two AWS receivers: one to detect standard strength track magnets and one to detect extra strength track magnets (the twin lightweight reed receiver and electronic versions are designed to detect either magnet type within a single housing). Where both receiver types are fitted on a dual system electric traction unit, the vehicle control circuitry is arranged to select the correct receiver depending on the traction current collection system in use. Diesel traction units generally use only a standard strength receiver, even if they also operate over lines fitted with extra strength track magnets. H.1.9 Locomotives and other dual-cab vehicles are normally only fitted with one receiver and control unit which feed indications in either cab, as shown in Figure 12. H.1.10 The receiver is mounted underneath the driving vehicle, either on the bogie or suspended from the vehicle underside, nominally on the centre line of the vehicle, and within a height range that keeps the equipment both within kinematic gauge and able to respond to the minimum track magnet field strength specified in GERT8075 under all dynamic conditions. The receiver cable is connected to a junction box which forms a coupling and test point.

AWS alarm and indicator unit H.1.11 The AWS alarm and indicator unit provides the main interface with the driver for AWS indications. The unit contains an electronic tone generator for the ‘caution’ (approximately 800 Hz continuous tone) and ‘clear’ (approximately 1200 Hz chime tones), and contains the yellow / black visual indicator (also known as the sunflower indicator) to remind the driver of the previous signal aspect and actions taken. The unit is mounted in a position where the driver may readily see it from the normal driving position. Several versions of this equipment exist, including those with a mechanical sunflower and those with LED arrays to provide the yellow element of the sunflower. H.1.12 Older installations may have separate audible (bell and horn) and visual (sunflower) indicators. These generally have conventional electric trembler bells, which ring for 0.5 s for a clear signal, and pneumatic horns, although the horn may be of the ‘Yodalarm’ electric type. H.1.13 Where provided separately, the visual ‘sunflower’ indicator is normally of a mechanical type and is larger than the combined alarm and indicator unit type. It contains a bi-stable electromechanical device with a magnetic circuit incorporating two coils, and is magnetically latched in either of its two positions. Luminous paint is applied to the yellow segments, so that the ‘black and yellow’ indication can be seen in the dark.

Page 106 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

TPWS aerial H.1.14 The TPWS aerial receives the six TPWS frequencies transmitted from the track- mounted transmitter loops as set out in GERT8075. The aerial, in conjunction with the control unit, may be capable of undertaking an integrity test as part of its inbuilt self- testing routines. H.1.15 The aerial is mounted underneath the leading vehicle (either on the bogie or suspended from the vehicle underside) nominally on the centre line of the vehicle, and within a height range that keeps the aerial both within kinematic gauge and able to respond to the minimum track transmitter loop field strength specified in GERT8075 under all dynamic conditions. H.1.16 For dual-cab vehicles, for example locomotives, two TPWS aerials are required, one at each end, to prevent an unwarranted TPWS brake application due to detection of signal ‘self-reversion’. Self-reversion is the result of the signal returning to danger (red aspect) due to the passage of the train, which will cause the transmitter loop to become active. If the TPWS aerial has not passed clear of the transmitter loops at the signal when they become active, then the brakes would be applied by TPWS as an unwarranted application. Self-reversion could also occur on a single-cab vehicle if the aerial is mounted more than 2.3 m behind the leading wheelset.

Driver’s control panel or DMI H.1.17 The driver’s TPWS control panel (also known as the driver’s display unit or driver’s display panel) or driver / machine interface (DMI) consists of TPWS status indicators and a Train Stop Override (TSO) pushbutton. H.1.18 Older equipment incorporates a single brake demand indicator which indicates one of three TPWS brake demand states: a) Unlit – no demand requested. b) Flashing – TPWS fault detected. c) Steady – TPWS temporarily isolated. H.1.19 Newer types of display equipment incorporate three separate brake demand indicators, as set out in 5.4 and Appendix B.1: one for brake applications initiated by TPWS TSS (coloured red), one for brake applications initiated by TPWS OSS (coloured yellow) and one for an AWS brake application (also coloured yellow). Each of these indicators will show one of the three brake demand states, as set out above. H.1.20 The driver’s control panel / DMI also contains indications of TPWS temporary isolation and faults, which are usually combined in a single indicator. A combined temporary isolation / fault indicator indicates three states: a) Unlit – TPWS operational. b) Flashing – TPWS fault detected. c) Steady – TPWS temporarily isolated. H.1.21 The TSO control is operated by the driver when it is necessary to pass a signal at danger with the authority of the signaller. In this case, the TSS on the track will still be transmitting and hence the train would be tripped on a legitimate movement past the stop signal. However, the driver can operate the TSO, which will prevent a brake

RSSB Page 107 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

demand from the first TSS the system encounters within a time period. The time period is preset to 20 s for a passenger train or 60 s for a freight train. After the time period, or on detecting the first TSS, the TSO will be reset to normal. When the TSO function is in operation, the TSO pushbutton (or associated indication) illuminates steady yellow.

AWS reset pushbutton / TPWS acknowledgement H.1.22 The AWS reset pushbutton (sometimes referred to as the AWS acknowledgement pushbutton) is also part of the driver’s interface and is mounted on, or built into, the driver’s desk such that it can be readily operated from the driving position. The pushbutton contains a changeover contact which allows the AWS receiver to reset, the audible indication to be silenced and the visual indication to be set to ‘yellow / black’. H.1.23 On older systems, the AWS reset pushbutton is also used to acknowledge a TPWS brake demand. When pressed after a TPWS brake demand, the control unit receives an acknowledge input which will enable the release of the TPWS brake demand in combination with a preset timer. H.1.24 On newer systems equipped with three brake demand indicators (compliant with GERT8030 issue three or later standards), a brake demand is acknowledged by pressing the appropriate push button associated with the brake demand indication which has been activated.

Full isolation switch and indicator H.1.25 A full isolation switch is provided for the driver to isolate the AWS and TPWS trainborne sub-system in the case of faults where: a) The brakes will not release, or b) The AWS audible indications will not silence, or c) A succession of incorrect or spurious responses are given by the AWS or TPWS systems. H.1.26 Various types of isolation switch exist: older types may be retained in the normal position with a seal or locking wire to deter abuse, while more modern installations are arranged such that the switch once operated cannot be reset by the driver. On older locomotives the full isolation switch may be incorporated with the change end switch. H.1.27 Full isolation of AWS will also render the TPWS system isolated (and vice versa) as the control unit also includes TPWS functionality. A TPWS temporary isolation switch is provided to overcome this limitation when only TPWS may be at fault. H.1.28 Full isolation is required to be indicated to the driver by a discrete indication or as part of a general safety system isolation indication. This is achieved on older vehicles by the visible position of the isolation switch and on modern vehicles by an illuminated indicator. The full isolation switch is required to: a) Ensure that the power supply is isolated from the AWS trainborne sub-system. b) Ensure that no AWS or TPWS brake demand is or can be actioned. c) Ensure that all indications except the isolation status indicator are inoperative.

Page 108 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

d) Provide a clearly visible indication that enables a trainborne sub-system isolation to be detected in all relevant driving positions. e) Provide an output to the train’s data recorder, where fitted, to indicate that the complete system is isolated.

TPWS temporary isolation switch H.1.29 A TPWS temporary isolation switch is provided to allow the TPWS to overcome a fault in the sub-system which does not affect the AWS functions, for example a faulty TPWS antenna. H.1.30 The switch is centre-biased to the ‘off’ position so that when the equipment is powered down and on again, any existing temporary isolation will be removed. H.1.31 The switch is mounted out of reach from the normal driving position. H.1.32 On some dual-cab vehicles only one temporary isolation switch is provided.

AWS isolation switch H.1.33 On newer vehicles a separate AWS isolation switch may be provided to allow isolation of the AWS functions in case of a failure, for example one which prevents release of an AWS brake application, while allowing the TPWS to continue in operation. H.1.34 On older vehicles there is no facility to isolate the AWS separately from the TPWS.

RSSB Page 109 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Appendix J AWS and TPWS Trainborne Equipment - Fault and Failure Management

Note: AWS Fault Codes are defined in RIS-0707-CCS.

J.1 Process for investigating right side AWS and TPWS trainborne equipment failures J.1.1 The process shown in Figure 13 is recommended to reduce the incidence of trainborne equipment being identified as faulty following a failure report when the failure was actually due to external influences. This will help to reduce cases where the equipment is sent for investigation but no fault is found. This process makes use of new technologies that have been produced for fault diagnosis. J.1.2 Various equipment exists to conduct a full AWS and / or TPWS test. A simple AWS functional test can be carried out using a hand-held magnet, as set out in Appendix K. Other test equipment should be used in accordance with the manufacturer’s instructions. J.1.3 Depot test procedures, as laid down in vehicle maintenance instructions, should be followed. If any item is identified as the cause of the fault, then it should be removed, sent for repair and a new item refitted. If the reported fault can be repeated, but changing the suspected faulty item does not cure the fault, then the fault is likely to be caused either by another faulty item of equipment, or the vehicle wiring. If the vehicle wiring is suspected to be faulty, it may need to be continuity and insulation tested if no obvious faults can be identified. J.1.4 After removing and / or changing any equipment, a full AWS and / or TPWS test should be conducted before releasing vehicles back into service.

Page 110 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Figure 13: AWS/TPWS right side failure investigation process

RSSB Page 111 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

J.2 Process for investigating wrong side AWS and TPWS trainborne equipment failures J.2.1 The process shown in Figure 14 is recommended to reduce the incidence of wrongly diagnosed faulty equipment due to external influences, and in light of the new technologies that have been produced for fault diagnosis. This process relies on the use of approved test equipment such as the STS / Mors Smitt TY287 AWS tester. J.2.2 The AWS control unit and receivers are often sent to an approved technical investigation centre following a reported AWS code 5 or 7 failure, as the equipment is often assumed to have suffered a wrong side failure. However, in many cases the technical investigation centres are unable to find any faults with the equipment under investigation. In some cases, reported AWS code 5 or 7 failures have been caused by the trackside AWS equipment or by traincrew errors. J.2.3 Similarly for TPWS, alleged wrong side failures may be due to track-mounted equipment faults, driver error or operational circumstances, as identified in the common causes sections. J.2.4 TDR data should be downloaded at the earliest opportunity by maintenance depot staff, to avoid it being overwritten or otherwise lost. TDR data should be supplied to the technical investigation centre to aid its investigation. This evidence may assist experts to pinpoint the cause of the failure, which may lie in the train wiring or ancillary components such as the AWS acknowledgement pushbutton. Technical investigation centres may in turn seek advice from the relevant AWS/TPWS supplier(s).

Page 112 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Figure 14: AWS wrong side failure investigation process

RSSB Page 113 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

J.3 Managing defective AWS and TPWS trainborne components J.3.1 Defective AWS and TPWS components should be managed in accordance with the RU’s quality procedures, in order that defective components are segregated, labelled, and despatched for repair or scrap, as appropriate. J.3.2 For example, faulty items of AWS and TPWS equipment which have been involved in a right side failure should be treated as follows: a) The equipment should be adequately packed, using special packaging, where available, and be clearly labelled as 'AWS/TPWS equipment for repair'. b) Equipment changed as a result of a 'right side failure’ should be sent to the appropriate repair agent for repair. J.3.3 Faulty items of AWS and TPWS equipment which have been involved in a wrong side failure should be treated as follows: a) The equipment should be adequately packed, using special packaging, where available, and have an appropriate label, generally coloured red, identifying the urgent nature of the package attached prior to dispatch. A wrong side failure report form should also be enclosed in the package. b) Equipment changed as a result of a wrong side failure should be sent for technical investigation to an approved, competent technical investigation body. It is expected that a competent technical investigation body will provide detailed feedback to the RU on the nature of the defects found, as this may require further action on behalf of the RU on its fleet and, in certain cases, ‘urgent’ advice being given to other operators. c) Equipment sent for technical investigation and / or repair should be properly labelled and accompanied by sufficient information to enable the investigators or repairers to properly diagnose and rectify faults. This information should include relevant TDR data, which may be sent electronically. A copy of the TDR data should be retained by the depot for possible future analysis that may be required following investigation by the technical investigation body.

J.4 Fault-finding techniques for defective AWS and TPWS trainborne equipment J.4.1 A traditional method of diagnosing AWS faults has been to use an AWS hand-held test magnet waved under the receiver to simulate the train passing over the AWS track magnets and hence functionally test the system (see Appendix K). Functioning the AWS system with a hand-held test magnet has the advantage of easily and quickly testing the AWS trainborne sub-system. Replacement of key components can be undertaken to remedy the fault, having tracked down the likely faulty component using a systematic process, in part using test equipment. More sophisticated test equipment is now available to supplement the basic functional test, thus allowing faults to be detected and healthy equipment to be identified more reliably. J.4.2 For all fault-finding techniques, some basic checks should be undertaken first, as follows: a) Check the vehicle records and component tracker system, to determine whether the vehicle has been involved in any AWS related incident within the last 12 months.

Page 114 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

b) Measure and record the height of the bottom of the AWS receiver above rail level. This should be within the limits applicable to the vehicle concerned (as specified in the vehicle maintenance instruction). Standard electromechanical AWS receivers are commonly mounted within the range 133 mm to 171 mm above rail level, and the recommended height range for Thales electronic AWS receivers is between 165 mm and 185 mm above rail level. Receiver height should be adjusted, as necessary, on vehicles where adjustment is provided. Standard strength AWS receivers running over high-strength track magnets are commonly set towards the upper end of the permitted height range to avoid spurious right side failures by detecting high magnetic fields generated by cross- track traction cables, but if they are set too high this can result in failure to detect normal strength magnets and hence wrong side failures. Further, the TY309 AWS characterisation tester may be used to adjust the generic receiver height tolerance for particular vehicles. c) Examine items of equipment for possible causes of intermittent fault, for example external damage, loose connectors or water ingress to connectors. J.4.3 The fault diagnosis procedures should enable faulty equipment to be reliably diagnosed. If a fault persists, for example two repeat failures in three months, but cannot be traced by functional testing or the use of the various test equipment, and a fault to the vehicle frame (earth fault) is suspected, then wiring checks should be carried out to trace any possible wiring faults, as follows: a) Visually examine, as far as is possible, all items of the AWS/TPWS trainborne sub- system carefully for possible causes of an intermittent fault, for example external damage, loose connectors, water ingress or defective wiring. b) Disconnect wiring connectors from components likely to be affected by insulation testing, for example: i) The AWS receiver. ii) The TPWS aerial. iii) The AWS alarm and indicator units (if fitted) and bells(s) / Yodalarm / horn (if fitted). iv) The AWS/TPWS control unit. v) The TPWS driver’s control panel / DMI. vi) The EP repeat relay (if fitted). vii) The EP valves (if fitted) and voltage converter (refer to relevant vehicle instructions). viii) Train data recorder or similar equipment. ix) All electronic equipment on the vehicle (or interconnected vehicles) not capable of withstanding the insulation test voltages likely to be applied. c) Using an insulation tester (500 V or 1000 V), check that the cable insulation resistance between AWS/TPWS cables and all other cables running with them (refer to vehicle wiring diagrams) is not less than 10 MΩ (wire to wire and wire to earth). d) Using an insulation tester, check that the cable insulation resistance between each AWS/TPWS cable and the vehicle chassis is not less than 10 MΩ.

RSSB Page 115 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

J.4.4 Further guidance on possible fault causes is given in J.5. J.4.5 In addition, data from train data recorders and train management systems may include data related to the operation and performance of both the AWS system and the train control systems at the time of the fault. When fault finding, consideration should be given to downloading and analysing the data to assist in fault finding. These systems may also directly log the nature of the fault depending on the complexity of the installation. J.4.6 Data from a train data recorder may also enable determination of any driver errors that may have led to an unintended (spurious) automatic brake application by the AWS. For example, a reported spurious brake demand could be due to late operation of the AWS reset pushbutton, or holding down the AWS reset pushbutton before the system detects the track magnet south pole. The sequence and timing of these actions could be identified from the train data recorder. J.4.7 A reported AWS or TPWS trainborne fault could be the symptom of an infrastructure fault, although this may not always be apparent. For example, an AWS fault code 8 (horn when no indication expected) could be due to the AWS receiver on the train detecting a magnetic flux from a cross-track cable, possibly as a result of a cable fault. J.4.8 Data from train management systems may also provide a precise location (for example, Ordnance Survey Grid Reference) which can be forwarded to the IM to investigate.

J.5 Guide to possible AWS and TPWS trainborne equipment faults J.5.1 A guide to possible causes and remedies for AWS/TPWS failures associated with a combined electronic AWS/TPWS control unit is given in Figures 15 and 16 below. The flowchart in Figure 16 is based on the power-up and self-test routine, following a sequence from power-up of the system through the equipment automatic self-test routine. These flowcharts have been published for information purposes only and do not take precedence over approved vehicle maintenance and fault-finding procedures. J.5.2 Some TPWS systems have improved fault reporting that may be used to trace a fault. This can be used in conjunction with the TDR data to assist in finding the cause of any fault.

Page 116 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Note: Fault codes 12-15 are not relevant to this document Figure 15: Combined AWS/TPWS fault finding guide

RSSB Page 117 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Figure 16: Combined AWS/TPWS system fault-finding flowchart

Page 118 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

J.6 Common AWS and TPWS failure mechanisms J.6.1 Some common AWS and TPWS failure mechanisms are set out below. These are categorised into human error, system faults and trainborne sub-system equipment faults.

Type of fault Category of fault Possible cause

AWS failed system power- System fault A cab is opened up with up test the AWS receiver directly over an AWS magnet

Unwarranted AWS brake Human error Driver not resetting AWS application within the specified caution acknowledgement period

AWS fault code 1 (horn Trainborne equipment Spurious switching of AWS and bell when clear receiver – fault in AWS indication expected) receiver or cable

AWS fault code 2 (horn System fault Faulty track magnet (for instead of bell when clear example electromagnet indication expected) fault or field strength out of specification). AWS receiver on the train marginal sensitivity or mounted too high or passing over magnet at extreme of suspension movement

AWS fault code 2 (horn Trainborne equipment AWS receiver faults – instead of bell when clear check AWS receiver height indication expected) and sensitivity

AWS fault code 3 (no Trainborne equipment AWS alarm and indicator indication instead of bell) unit or bell fault

RSSB Page 119 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Type of fault Category of fault Possible cause

AWS fault code 4 (bell and Trainborne equipment Reed AWS receivers horn when warning operating over extra indication expected) strength magnets, particularly at slow speed, may give rise to AWS code 4 failures as a result of incorrect operation of internal relays within the receiver. This fault could be masked in older relay based logic units by the timing of relay operation, but was revealed following the fitting of electronic control units. A possible solution would be to replace the reed AWS receiver with an electronic solid state AWS receiver

AWS fault code 5 (bell Trainborne equipment Permanent reset voltage instead of horn) on AWS receiver due to short circuit on AWS reset WRONG SIDE FAILURE pushbutton or faulty control unit

AWS fault code 5 (bell System fault False energisation of an instead of horn) AWS receiver by unintentional magnetic WRONG SIDE FAILURE flux – may be a particular issue for standard strength receivers operating over extra strength magnets

AWS fault code 6 (brake Trainborne equipment AWS alarm and indicator without horn) unit or horn fault

AWS fault code 7 (no System fault False energisation of indication or brake when anAWS receiver by warning indication unintentional magnetic expected) flux – may be a particular issue for standard strength WRONG SIDE FAILURE receivers operating over extra strength magnets

Page 120 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Type of fault Category of fault Possible cause

AWS fault code 6 (brake Trainborne equipment AWS alarm and indicator without horn) unit or horn fault

AWS fault code 7 (no System fault Faulty track magnet (for indication or brake when example permanent warning indication magnet field strength out expected) of specification) WRONG SIDE FAILURE

AWS fault code 7 (no Trainborne equipment AWS receiver failed to indication or brake when detect track magnet – warning indication check AWS receiver height expected) and sensitivity WRONG SIDE FAILURE

AWS fault code 8 (horn System fault Trainborne equipment when no indication detecting a strong expected) magnetic field from non- AWS trackside infrastructure, for example high currents passing through cross-track traction cables

AWS fault code 8 (horn Trainborne equipment AWS receiver failure when no indication expected)

AWS Fault Code 9 (bell System fault Trainborne equipment when no indication detecting a strong expected) magnetic field from non- AWS trackside infrastructure, for example high currents passing through cross-track traction cables

AWS fault code 10 (unable Human error Driver holding down the to cancel) AWS reset pushbutton before the AWS caution audible tone is sounded

RSSB Page 121 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Type of fault Category of fault Possible cause

AWS fault code 10 (unable System fault A cab is opened up with to cancel) the AWS receiver directly over an AWS magnet

AWS fault code 10 (unable Trainborne equipment Identified issue with to cancel) Thales Mark I control units prior to modification status strike 4

AWS fault code 11 Trainborne equipment AWS alarm and indicator (indicator not changing to unit or sunflower fault ‘all black’)

TPWS failed system System fault A cab is opened up with power-up test the TPWS aerial directly over an active TPWS transmitter loop (affects older systems; newer systems may be able to cope with this situation)

TPWS fault code 16 (TPWS Trainborne equipment TPWS aerial not correctly failed to activate) located (possibly due to movement of the aerial WRONG SIDE FAILURE within the assembly) but electrically still connected to control unit – possible solution is to install a composite aerial harness which has a mechanical location

TPWS fault code 16 (TPWS System fault Faulty TPWS transmitter failed to activate) loop WRONG SIDE FAILURE

TPWS fault code 17 (TPWS Human error Over-speeding on OSS for operated when not signal or PSR required) TPWS not temporarily isolated when required TPWS TSO not operated or timed out before passing signal at danger with authority

Page 122 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Type of fault Category of fault Possible cause

TPWS fault code 17 (TPWS System fault Thales Mark I modification activated when not 0 control units could required) generate a brake demand due to trainborne equipment detecting a valid sequence of signals when travelling reverse direction over TSS Trainborne equipment detecting TPWS frequencies from trackside infrastructure, specifically the harmonics of certain TI21 track circuit transmitters (higher risk if TPWS aerial is ahead of the leading axle) TPWS OSS still active for movement controlled by subsidiary signal (standard arrangement is now to suppress OSS when subsidiary signal off) TPWS ‘self-reversion’ due to TPWS TSS reactivated before TPWS aerial clear of transmitter loops Trainborne equipment wrongly interpreting OSS transmitter loop lobes as main field at low speed (experienced as a widespread problem at terminal stations where full size OSS loops were fitted on approach to buffer stops – generally avoided by changing to miniature loops)

RSSB Page 123 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Type of fault Category of fault Possible cause

Failure of TDR to record Trainborne equipment Failure of control unit TDR AWS/TPWS outputs output relay volt-free contacts soft-sticking due to inrush current damage

AWS/TPWS brake Trainborne equipment Thales control units prior application delay to modification strike 2 subject to internal brake POSSIBLE CAUSE OF demand relay failure WRONG SIDE FAILURE (sticking armature) – replace and return to Thales

Flashing fault light on Trainborne equipment Intermittent connection driver’s control panel problem between TPWS aerial and connecting cable (solutions are to replace the aerial/cable connector arrangement with a hard-wired aerial or improve the securing mechanism for the aerial/ cable interface). Check the aerial for continuity

Table 19: Common AWS/TPWS faults

Note: Fault codes 12-15 are not relevant to this document

Page 124 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Appendix K AWS Testing using a Hand-Held Permanent Magnet

K.1 AWS testing using a hand-held permanent magnet K.1.1 An AWS hand-held test magnet can be used, as set out in Table 20 below, to check the functioning of the AWS trainborne sub-system to detect where, within the basic sequence of events, a fault occurs. Testing the AWS trainborne sub-system with a hand-held test magnet has the advantage of rapidly repeating the failure. Dual-cab vehicles should be tested from both ends, as failure at one end only will indicate that the control unit, PSU and AWS receiver are healthy. Test item Action

A1 Before any equipment or connections are disturbed, perform the tests set out in items A2 to A8.

A2 With the air system fully charged, energise the AWS in the cab in which the failure is reported to have occurred

A3 Check that the horn sounds. Press and release the 'AWS acknowledge' pushbutton to silence the horn

A4 Carry out a caution signal test cancelling the AWS as follows: • Simulate a caution indication by passing the south pole (blue) end of the magnet under the AWS receiver. • The indicator should change to or remain 'all black', and after 1 s the horn should sound. • Within 2 s, press and release the 'AWS acknowledge' pushbutton to silence the horn − the indicator should change to 'yellow and black' and there should be no brake application.

A5 Carry out a caution signal test allowing a full brake application and then cancel the AWS, as follows: • Simulate a caution indication by passing the south pole (blue) end of the magnet under the AWS receiver. • The indicator should change to or remain 'all black', the horn should sound after 1 s and, after a further time delay (2.0 s or 2.7 s) appropriate to the vehicle concerned, a full brake application should occur. • Press and release the 'AWS acknowledge' pushbutton − the horn should be silenced and the indicator should change to 'yellow and black' and, after a time delay appropriate to the vehicle concerned, the brake should release at least 59 s after the brake application

RSSB Page 125 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Test item Action

A6 Carry out a caution signal test allowing a partial brake application and then cancel the AWS, as follows: • Simulate a caution indication by passing the south pole (blue) end of the magnet under the AWS receiver. • The horn should sound after 1 s. As soon as the brake starts to apply, press and release the 'AWS acknowledge' pushbutton to silence the horn − the brake should continue to apply and should not release until after a time delay appropriate to the vehicle concerned

A7 Carry out a clear signal test as follows: • Simulate a clear indication by passing the south pole (blue) end of the magnet under the AWS receiver and then passing the north pole (red) end of the magnet under the AWS receiver, taking less than 1 s between the two operations. • The indicator should change to 'all black’ and the bell ring for approximately 0.5 s (or a single chime is emitted on vehicles fitted with an alarm and indicator unit)

A8 Carry out a test with the AWS equipment isolated, as follows: • Isolate the AWS in the cab concerned. • Operate the AWS receiver with the south pole (blue) end and then the north pole (red) end of the magnet, taking less than 1 s between the two operations. Follow this by operating the AWS receiver with the south pole (blue) end only − there should be no effect on the AWS equipment. • De-isolate the AWS in the cab concerned

A9 If any item of AWS equipment is suspected of being faulty it should be changed. After the replacement has been fitted repeat items A4 to A8 three times, if either: • The reported fault can be reproduced, but changing the item indicated during the above tests does not cure it, or • The fault cannot be reproduced but the vehicle has a history of related faults. Check the system using an AWS test unit, if available, then visually examine the wiring and connectors as far as reasonably practicable. If the fault is still not revealed, then detailed wiring tests should be carried out

Page 126 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Test item Action

A10 After any equipment change, wiring repair or renewal has been carried out, items A4 to A8 should be repeated

Table 20: Test after a 'right side failure’ reported K.1.2 An AWS hand-held test magnet can be used, as set out in Table 21 below, to check the functioning of the AWS trainborne sub-system as part of a wrong side failure investigation before any equipment / connections are disturbed. This should be as part of an overall inspection and test procedure using more sophisticated AWS test equipment. Test item Action

B1 Carry out items A2 to A8, repeating items A4 to A8 a total of three times

B2 If any item of AWS equipment is suspected of being faulty it should be changed. If the AWS operates correctly or does not reproduce the reported fault, then follow procedures for a full system test. After replacements have been fitted, items A2 to A8 should be repeated, if either: • The reported fault can be reproduced, but changing the item indicated during the above tests does not cure it, or • The fault cannot be reproduced but the vehicle has a history of related faults. Check the system using an AWS test unit, then visually examine the wiring and connectors as far as reasonably practicable. If the fault is still not revealed, then detailed wiring tests should be carried out

B3 After any equipment change, wiring repair or renewal has been carried out, items A4 to A8 should be repeated

Table 21: Test after a 'wrong side failure’ reported

RSSB Page 127 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

Appendix L Guidance on AWS Route Compatibility Assessments

L.1 Guidance on AWS route compatibility assessments L.1.1 If on a route it is proposed to replace AWS track equipment of one type (standard or extra strength) by equipment of the other type, the IM assesses the risks of so doing, taking into account the types of AWS receivers fitted to trains that operate on the route. Trainborne AWS receivers are required to be compatible with the AWS track equipment on the routes over which they operate, therefore changing the type of magnet may introduce incompatibility with existing receivers. L.1.2 In some cases, non-standard arrangements of AWS equipment have been introduced to deal with particular situations. In such cases, changing the type of magnet (even if this change is from an existing non-compliant arrangement to a compliant arrangement) may introduce incompatibility with trainborne receivers which work satisfactorily with the existing track equipment. L.1.3 Where route compatibility is being assessed, as set out in RIS-8270-RST, the AWS receiver arrangements on a train are assessed to determine whether they are compatible with the type of AWS track equipment on the route over which the train is to operate. This is particularly relevant where a single sensitivity receiver is to be operated over both standard strength and extra strength track equipment. L.1.4 Where it is necessary for a train not fitted with AWS equipment to operate over an AWS fitted line, except where an alternative train protection system providing a level of protection equivalent to or better than that provided by AWS and TPWS is fitted and in use on both the trains and the infrastructure, the IM and RU agree, document and implement appropriate operating procedures to enable the safe movement of trains. Agreed operational procedures are used to manage the risks arising from the operation of trains not fitted with AWS on a line where AWS is provided as a primary safety system.

Page 128 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Definitions

Arming frequency A frequency generated by the TPWS track sub-system which, when detected by the vehicle, arms the train sub-system. AWS Automatic Warning System. Availability The ability of an item to be in a state to perform a required function under given conditions at a given instant of time or over a given time interval, assuming that the required external resources are present. (Source BS EN 50129:2003.) DC electrified lines Lines equipped with DC electrification, whether or not the line is also equipped with AC electrification. Driver machine interface (DMI) The driver machine interface provides indications to the driver of the system status, as well as allowing the driver to control selected system functions. The AWS/TPWS DMI includes controls and indications which are grouped together and incorporated in a panel or VDU display as well as other controls and indications relating to AWS and TPWS which are provided as discrete devices elsewhere in the rail vehicle. Driving position The normal position from which the driver controls the train, by operating the primary controls, as set out in GMRT2161. The active driving position is the position being used by the driver to drive the train. Excessive speed With reference to provision of TPWS on the approach to speed restrictions, a speed exceeding the overspeed margin above which derailment risk is considered to require mitigation. Interleaving An arrangement where the arming or trigger transmitter of one pair of TPWS track transmitters is positioned between a different pair of TPWS track transmitters. Nesting An arrangement where one pair of TPWS track transmitters is positioned in between a different pair of TPWS track transmitters. Overspeed system (OSS) A TPWS facility whose function is to initiate a brake application on a train that approaches a signal showing a danger aspect, or other location, at excessive speed (also referred to as the overspeed sensor system). Primary control

RSSB Page 129 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

A control essential for the safe driving of a train or rail vehicle, operable by the train driver from the normal driving position. Running line A line as shown in Table A of the Sectional Appendix as a passenger line or as a non-passenger line. Set speed The minimum speed at which a brake application is initiated when a train passes over the track elements of an active OSS. Soft key A type of VDU display using context-dependent physical keys for input adjacent to an associated label within the display area. SPAD Signal passed at danger. Suppression (AWS and TPWS trainborne sub-systems) A state of the trainborne sub-system where it is does not provide operational outputs to the driver or initiate brake demands, for example when an alternative train control system is in use and AWS indications and TPWS interventions are not required. The system is still active in monitoring its status and may indicate fault conditions. Suppression (AWS magnets) The application of an opposing magnetic field to an AWS permanent magnet to prevent the detection of the permanent magnet when a train is not required to receive an AWS indication. Touch screen A type of VDU display using the display area for inputs by means of programmable sensitive areas. TPWS Train Protection and Warning System. TPWS Miniature Loop A TPWS transmitter loop smaller than the standard loop, which is used at OSS installations on the approach to buffer stops and certain other locations where speeds are low. TPWS Standard Loop A TPWS transmitter loop of standard dimensions, which is used at all TSS installations and at most OSS installations, except on the approach to buffer stops. TPWS temporary isolation switch A switch provided in the cab whereby the TPWS can be temporarily isolated. Track sub-system The TPWS track sub-system comprises the components mounted on the track or at the trackside that are used to provide the train stop system (TSS) and OSS functionality. Page 130 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Train Data Recorder (TDR) A device to record data concerned with the performance of on-board systems. Also known as ‘On Train Monitor and Recorder’ (OTMR). Train stop override The facility that allows a train to pass a signal at danger without invoking a brake demand caused by the train stop system (TSS). Train stop system (TSS) A TPWS facility whose function is to initiate a brake application on a train that passes a signal at danger without authority. Train sub-system The TPWS train sub-system comprises the components mounted on vehicles that are used to provide TSS and OSS functionality. Trigger delay The pre-set period timed by the train sub-system and initiated by detection of an OSS arming frequency. Trigger frequency A frequency generated by the TPWS track sub-system which, when detected by the vehicle, triggers the train sub-system. Vehicle For the purposes of this document the term vehicle is used to define that part of a train which is fitted with the AWS and TPWS equipment, where ‘train’ has the same meaning as in section 83(1) of the Railways Act 1993.

RSSB Page 131 of 133 Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard RIS-0775-CCS AWS and TPWS Application Issue: Two Date: December 2018 Requirements

References

The Standards catalogue gives the current issue number and status of documents published by RSSB: http://www.rssb.co.uk/railway-group-standards.

RGSC 01 Railway Group Standards Code RGSC 02 Standards Manual

Documents referenced in the text

Railway Group Standards

GERT8000 Rule Book GERT8075 AWS and TPWS Interface Requirements GKRT0075 Lineside Signal Spacing and Speed Signage GMRT2161 Requirements for Driving Cabs of Railway Vehicles GMRT2185 Train Safety Systems GMRT2472 Requirements for Data Recorders on Trains

RSSB Documents

RIS-0386-CCS Rail Industry Standard on Signal Overrun Risk Evaluation and Assessment RIS-0713-CCS Lineside Signalling Layout Driveability Assessment Requirements RIS-0737-CCS Signal Sighting Assessment Requirements RIS-0797-CCS ERTMS/ETCS Baseline 3 Onboard Subsystem Requirements: Retrofit RIS-0798-CCS ERTMS/ETCS Baseline 3 Onboard Subsystem Requirements: New Trains RIS-3437-TOM Defective On-Train Equipment RIS-8270-RST Route Level Assessment of Technical Compatibility between Vehicles and Infrastructure. (Will replace GERT8270: Assessment of Route Compatibility of Vehicles and Infrastructure) RS 522 AWS and TPWS Handbook T902 (RSSB Research TPWS audible warnings Project) T906 (RSSB Research ERTMS/ ETCS driver machine interface options for future train cab Project) design T1079 (RSSB Research Coexistent operation of ERTMS and Class B (AWS and TPWS) Project) systems: the development and user testing of an integrated DMI

Page 132 of 133 RSSB Uncontrolled when printed Supersedes RIS-0775-CCS Iss 1 with effect from 01/12/2018 Rail Industry Standard AWS and TPWS Application RIS-0775-CCS Issue: Two Requirements Date: December 2018

Other References

BS EN 16186-2:2017 Railway applications. Driver's cab. Integration of displays, controls and indicators BS EN 50121 Railway applications. Electromagnetic compatibility. General ERA_ERTMS_015560 ETCS Driver Machine Interface version 3.6.0 LOC&PAS TSI Commission Regulation (EU) No 1302/2014 concerning a technical specification for interoperability relating to the ‘rolling stock — locomotives and passenger rolling stock’ subsystem of the rail system in the European Union Noise TSI Commission Regulation (EU) No 1304/2014 on the technical specification for interoperability relating to the subsystem ‘rolling stock — noise’ The Railway Safety (Statutory Instrument 1999 no. 2244) Regulations 1999

RSSB Page 133 of 133